The CBN Directive on Publication of Delinquent Bank Debtors: Some Data Privacy Ramifications

Proshare

Sunday, December 06, 2020  / 09.57AM / OpEd By Olubunmi Abayomi-Olukunle* / Header Image Credit: DebtorsAfrica

 

Can a Bank legitimately disclose the names of individual debtors or obligors in the newspapers as a naming and shaming strategy for debt recovery? Does the NDPR provide any relief for such individual debtors or obligors?

 

Nigerian banks are entering a phase of increased regulatory supervision from both banking and non-banking regulators. In particular regard to data privacy compliance, commercial banks in Nigeria may be exposed to an additional layer of legal liability under the Nigerian Data Privacy Regulations (the "NDPR"), if they continue to comply with the directive from the Central Bank of Nigeria (CBN) to publish the names of delinquent borrowers in the newspapers.

 

In 2015, the CBN issued a directive to all banks and discount Houses (Banks) in Nigeria asking Banks to (a) give the delinquent debtors 3 (three) months of grace to turn their accounts from non-performing to performing status (b) publish the list of delinquent debtors that remain non-performing in at least three national daily newspapers quarterly (the Directive). According to the Directive, the delinquent debtors are customers whose accounts have been classified lost and includes related persons, entities, directors, subsidiaries and other related parties. Nigerian Banks continue to publish the names of delinquent borrowers in newspapers, in compliance with the Directive.  Recently, Access Bank issued a notice here to its customers notifying delinquent debtors of the Bank's decision to "publish our debtors' names in newspapers in two weeks".

 

Our considered view is that Banks and the CBN may be exposed to a claim for breach of personal data privacy and for monetary damages within the context of the NDPR. Here are some of the legal considerations [1]

 

Post-Script: For Publishing Debtors List - Court Dismisses N5bn Libel Suit against THISDAY, Diamond Bank - July 17, 2020

 

i)      Although a company's legal name does not constitute personal data under the NDPR, certain other debtor information, publically revealed by Banks constitutes personal data under the NDPR. Some of these include names, location data, I.P. addresses, phone numbers, addresses, photographs, emails and bank details of individual promoters, directors, guarantors, or other obligors (Individual Obligors/Obligor) of such delinquent entities. Additionally, the fact of indebtedness or the very existence of a debt, constitutes credit information and is a form economic identity and by that measure will qualify as personal data under the NDPR.

 

ii)    The act of disclosure or dissemination of the personal data collected by a Bank during a loan application or credit evaluation process, to a newspaper/media organization for publication, qualifies as processing activity as per the statutory definition of "processing" under the NDPR.

 

iii)  Based on 1 and 2 above, a Bank will generally stand in the position of a data controller in relation to the personal data of Obligors to the extent that an Individual Obligor is a natural person.

 

iv)   In order to process the information of Individual Obligors in the manner contemplated by the Directive (i.e. publication of a debtors' list in newspapers), a Bank needs to discover the lawful basis for such processing activity as per the provisions of the NDPR. That lawful basis could be "consent" as would be the case where the Bank inserts data sharing consent clauses in a commitment or offer letter authorizing the Bank to make such third-party disclosures in specific circumstances.

 

Proshare Nigeria Pvt. Ltd.


(v) Using consent in this instance is fraught with some challenges. We discuss some below

  • The insertion of data sharing consent clauses in commitment/offer letters is a relatively recent development in the standard debt financing documentation adapted by Banks, meaning that a Bank may be unable to claim the benefit of this clause in respect of some Individual Obligors, whose financing or security agreements did not bear those clauses
  • The model data sharing consent clauses in standard commitment/offer letters usually allows the Bank to share credit information only with licensed credit bureaus or with regulators and not in newspapers or on social media.
  • It is unusual for an Individual Obligor to consent to a publication of his/her name in the newspapers as a debt recovery mechanism. Even if this were possible, such consent could be vitiated as per provisions of the NDPR. It's important to note that the NDPR (as is the case with global data privacy regulations) sets a high standard for "consent" when used as a proxy for lawful basis. In order to justify processing based on "consent", a Bank would have to, amongst others, show that any such "consent" was expressly given in the form of a clear and specific statement of consent; further that the consent was obtained without fraud, coercion or undue influence.  An Individual Obligor may be able to make a case of duress, if made to agree to an unbalanced data sharing clause.
  • Data sharing consent clauses are usually contained in offer letters and hardly in other standard financing or security agreements. In many cases, Individual Obligors who sign guarantee or indemnity agreements are not within the contemplation of the data consent sharing clauses contained in financing documents. The standard form of the security or indemnity agreements adapted by Banks do not typically contain these clauses.

 

vi)   Another option open to a Bank would be to rely on legitimate interest as a lawful basis for complying with the Directive. The doctrine of legitimate interest effectively allows data controllers, (the Bank, in this case) to process personal data without the necessity of the consent of a data subject (an Individual Obligor, in this case), where such processing is necessary to protect the personal interest of a Data Controller or that of a third party. Such personal interest can broadly include commercial interests of the Bank or other broader societal interests. However, we note with some concern that there is no categorical provision in the NDPR which identifies legitimate interest as a lawful basis for processing personal data under the NDPR. This means that technically, Banks may not be able to rely on legitimate interest as a lawful basis for processing debtor information in the manner contemplated by the Directive.

 

vii) A Bank may also consider relying on legal obligation as a basis for processing debtor information in the manner contemplated by the Directive. This principle allows the Bank to process personal data without the necessity of the consent of an Individual Obligor, where such processing is necessary to comply with a legal obligation. To the extent that the publication of an Obligor's personal information in the newspaper is in furtherance a directive from the CBN, a Bank may seek to rely "legal obligation" as a lawful basis.  Although relying on legal obligation may appear to be a more convincing "lawful basis", the important point to note is that the determination of the lawful basis of an intended or an actual processing activity, requires critical thought as there may be different considerations for different categories of data, for the same processing activity and in the same data controller organization. There could also be other legal considerations that go to the root of data privacy activities carried out by regulated entities. For instance, in this case, the author of the Directive, the CBN, is itself subject to the NDPR and to regulatory supervision by NITDA on data privacy issues. On that basis, the legality of the Directive can be challenged with a reasonable prospect of success. In that event, public interest, a legal doctrine also recognized as a lawful basis for processing an Obligor's personal data in the absence of consent will likely determine where legal liability rests as well as the provisions of the CBN Act and BOFIA [2]. The CBN may have to demonstrate that the publication of the personal data of Individual Obligors serves a public interest, notwithstanding the fact that the Banks have the benefit of security.

 


Proshare Nigeria Pvt. Ltd.

 

Third Party Liabilities?

Yes. Newspapers or other media organizations who publish the personal data of Individual Obligors may also be exposed to legal liability under the NDPR by publishing the personal data of Individual Obligors. It's particularly important to note that the NDPR does not provide a specific journalistic exemption for media publishers and their journalist employees. The practical implication of this exclusion is that media organizations may not be able to rely successfully on the premise that such publication was done in the "public interest or in the exercise of press freedom, when faced with a legal action from Nigerian claimants who claim that their personal rights have been infringed by a media company or journalist.

 

In closing

The resolution of some of these issues are not possible without definite administrative guidance from NITDA or a judicial determination on the merits. It is particularly important to note there may also be constitutional law implications. The NDPR specifically made provisions mandating the interpretation of the NDPR in accordance with constitutionally guaranteed principles and enforcement of fundamental rights. This is significant for Banks and other data controllers for two primary reasons; Firstly, this provision effectively changes the character of a data privacy claim and subjects defendants in a data privacy litigation matter to a higher legal standard in the form of a constitutional obligation.

 

In a sense, provides Nigerian courts with a new canvass for analysing privacy rights as relates to the use and collection of personal data by corporate entities. Secondly, Nigerian courts take fundamental human rights issues very seriously and treat those issues speedily based on special enforcement procedure and evidence rules. In practice, a great majority of fundamental human right breach cases succeed in Nigerian courts.

 

It helps to contemplate and resolve these issues early on. 

 

Proshare Nigeria Pvt. Ltd.


About Author

Olubunmi Abayomi-Olukunle is a partner and Lead Counsel at the Private Equity, Venture Capital & Emerging Companies sector-focused, specialist investment & finance law firm of Balogun Harold - www.balogunharold.com or via e-mail: olu@balogunharold.com   

 

The above article was written on May 21, 2020 and titled "Re: The CBN Directive to Nigerian Banks on the Publication of the Names of Delinquent Bank Debtors in the Dailies: Some Data Privacy Ramifications". Since then, we have published this judgment delivered by the courts - For Publishing Debtors List - Court Dismisses N5bn Libel Suit against THISDAY, Diamond Bank - July 17, 2020 

 

Proshare Nigeria Pvt. Ltd.

 

Related Posts - NPLs and The Debt Burden

  1. Executive Summary: NPLs & Bank Debtors - The Case for a New Industry Approach - May 14, 2020
  2. (PDF) NPLs & Bad Debtors: - The Case for a New Industry Approach - Debtors Africa, May 13, 2020
  3. Operational Guidelines on Global Standard Instruction (GSI) CBN, Jul 15, 2020
  4. Memo To AMCON: Nigerian Tax Payers are not Responsible for Repayment of Bad Debt - Jul 23, 2020
  5. AMCON and Financial Services Debt Burden in Nigeria - Aug 17, 2018
  6. Key Takeaways from the CBN GSI Guidelines and the Case for a New Approach
  7. CBN Issues Operational Guidelines on GSI to Facilitate Improved Credit Repayment Culture
  8. Debtors Africa: AMCON; Chike-Obi's Alternative View
  9. Debtors Africa Launches Searchable Digital Database of Recalcitrant and Delinquent Debtors
  10. (PDF) - Coronanomics and the Nigerian Economy - Jun 06, 2020  


 Proshare Nigeria Pvt. Ltd.


Related to NPLs and Recovery

  1. Bank NPLs (25) - The Customer's Options in a New Debt Order
  2. Bank NPLs (24) - Handling Bad, Delinquent and Recalcitrant Debtors via DiMR
  3. Bank NPLs (23) - The Case for a New Approach
  4. Bank NPLs (22) - Benchmarking Best Practice and International Debtors List
  5. Bank NPLs (21) - The Role and Place of Credit Bureaus and Rating Agencies in Recovery Efforts
  6. Bank NPLs (20) - A New Cottage Industry Emerges - Debt Factors and Loan Purchase Firms
  7. Bank NPLs (19) - Issues Around Nigerian Bank Debtors List
  8. Bank NPLs (18) - Understanding The Impact Of IFRS 9 On Selected Nigerian Banks
  9. Bank NPLs (17) - IFRS and Accounting Standards
  10. Bank NPLs (16) - The Place of Arbitration, Resolution or Debt Management
  11. Bank NPLs (15) - AMCON and Its Role in Debt Recovery
  12. Bank NPLs (14) - Regulatory Guidance, Conduct and Enablers
  13. Bank NPLs (13) - Impact on Growth of the Credit Market
  14. Bank NPLs (12) - Impact of NPLs on Income Trends
  15. Bank NPLs (11) - Technical Analysis on Banks' NPLs - LDR
  16. Bank NPLs (10) - Technical Analysis on Banks' NPLs - Leverage Ratio
  17. Bank NPLs (9) - Technical Analysis on Banks' NPLs - Liquidity Ratio
  18. Bank NPLs (8) - Technical Analysis on Banks' NPLs - NPL Ratio
  19. Bank NPLs (7) - Technical Analysis on Banks' NPLs - Profitability
  20. Debtors Africa: AMCON; Chike-Obi's Alternative View
  21. Bank NPLs (6) - Technical Analysis on Banks' NPLs - Gross Earnings
  22. Bank NPLs (5) - How Banks Fared In 2018; Holding Up Against IFRS9 Tropical Winds
  23. Bank NPLs (4) - A Short History of Recovery Efforts - A Time Series Analysis
  24. Bank NPLs (3) - The State of NPLs
  25. Bank NPLs (2) - The Banking Industry and Its NPL Position
  26. Bank NPLs (DR 1) - The Case for a New Industry Approach 

 

Proshare Nigeria Pvt. Ltd.

 

Data Protection/Privacy

1.      Mandatory Data Privacy Compliance for Nigerian Companies - A Data Audit Offer - Mar 02, 2020

2.      New Data Privacy Compliance Considerations in Cross Border M and A Transactions Facing Africa - Oct 31, 2019

3.      The Nigeria Data Protection Regulation - Compliance Requirements

4.      Report Sets Out Governance of Key OTC Derivatives Data Elements - Oct 09, 2019

5.      The Economics of Data - Sept 23, 2019

6.      How The General Data Protection Regulation Will Affect Your Business

7.     National Data Protection Regulations - Legal Alert


 Proshare Nigeria Pvt. Ltd.

 

Related News -Debtors & Recovery

1.               SEPLAT Plc Refutes Being Party to Cardinal Drilling Services Loan with Access Bank

2.              O and O Networks Limited and ETI Appeal Court of Appeal Judgement on Disputed Airtel Shares

3.              AMCON Takes Over Jimoh Ibrahim's Prime Assets Over N69.4bn Debt

4.              P and ID: Nigeria's Foreign Reserves Swell by $200m

5.              P and ID Loses Again as UK Court Orders Release of $200m Guarantee to Nigeria

6.              N4bn Debt: Court Grants AMCON's Request to Take Over Firm's Asset

7.              Progress in the P and ID Case

8.              Nigeria Floors P and ID as UK Court Grants Relief from $10bn Fine

9.              AMCON: Is There Scope for Improvement in Debt Recovery?

10.           The CBN's New GSI Policy - Dangers Ahead and Recommendations

11.            Accion MFB Konnect Series: Experts Call For Clarity On Regulations for MFIs Under the GSI Framework

12.           Memo To AMCON: Nigerian Tax Payers are not Responsible for Repayment of Bad Debt

13.           For Publishing Debtors List - Court Dismisses N5bn Libel Suit against THISDAY, Diamond Bank - July 17, 2020

14.           Key Takeaways from the CBN GSI Guidelines and the Case for a New Approach

 

 

Proshare Nigeria Pvt. Ltd.

Proshare Nigeria Pvt. Ltd.


Proshare Nigeria Pvt. Ltd.


READ MORE:
Related News
SCROLL TO TOP