The CBN Directive on Publication of Delinquent Bank Debtors: Some Data Privacy Ramifications

The CBN Directive on Publication of Delinquent Bank Debtors: Some Data Privacy Ramifications

Sunday, December 06, 2020  / 09.57AM / OpEd By
Olubunmi Abayomi-Olukunle* / Header Image Credit: DebtorsAfrica

 

Can a
Bank legitimately disclose the names of individual debtors or obligors in the
newspapers as a naming and shaming strategy for debt recovery? Does the NDPR
provide any relief for such individual debtors or obligors?

 

Nigerian
banks are entering a phase of increased regulatory supervision from both
banking and non-banking regulators. In particular regard to data privacy
compliance, commercial banks in Nigeria may be exposed to an additional layer
of legal liability under the Nigerian Data Privacy Regulations (the “NDPR”), if
they continue to comply with the directive from the Central Bank of Nigeria (CBN)
to publish the names of delinquent borrowers in the newspapers.

 

In
2015, the CBN issued a 
directive to all banks and discount Houses (Banks) in Nigeria
asking Banks to (a) give the delinquent debtors 3 (three) months of grace to
turn their accounts from non-performing to performing status (b) publish the
list of delinquent debtors that remain non-performing in at least three
national daily newspapers quarterly (the Directive).
According to the Directive, the delinquent debtors are customers whose accounts
have been classified lost and includes related persons, entities, directors,
subsidiaries and other related parties. Nigerian Banks continue to publish
the names of delinquent borrowers in newspapers, in compliance with the
Directive.  Recently, Access Bank issued a notice 
here to its customers notifying delinquent
debtors of the Bank’s decision to “publish our debtors’ names in newspapers in
two weeks”.

 

Our
considered view is that Banks and the CBN may be exposed to a claim for breach
of personal data privacy and for monetary damages within the context of the
NDPR. Here are some of the legal considerations [1]

 

Post-Script: For Publishing
Debtors List – Court Dismisses N5bn Libel Suit against THISDAY, Diamond Bank
 –
 July 17, 2020

 

i)     
Although a
company’s legal name does not constitute personal data under the NDPR, certain
other debtor information, publically revealed by Banks constitutes personal
data under the NDPR. Some of these include names, location data, I.P.
addresses, phone numbers, addresses, photographs, emails and bank details of
individual promoters, directors, guarantors, or other obligors (Individual
Obligors/Obligor
) of such delinquent entities. Additionally, the fact of
indebtedness or the very existence of a debt, constitutes credit information
and is a form economic identity and by that measure will qualify as personal
data under the NDPR.

 

ii)   
The act of
disclosure or dissemination of the personal data collected by a Bank during a
loan application or credit evaluation process, to a newspaper/media
organization for publication, qualifies as processing activity as per the
statutory definition of “processing” under the NDPR.

 

iii)  Based on 1 and 2 above, a Bank will generally stand in
the position of a data controller in relation to the personal data of Obligors
to the extent that an Individual Obligor is a natural person.

 

iv)  
In order to
process the information of Individual Obligors in the manner contemplated by
the Directive (i.e. publication of a debtors’ list in newspapers), a
Bank needs to discover the lawful basis for such processing
activity as per the provisions of the NDPR. That lawful basis could be “consent” as
would be the case where the Bank inserts data sharing consent clauses in a
commitment or offer letter authorizing the Bank to make such third-party
disclosures in specific circumstances.

 

Proshare Nigeria Pvt. Ltd.

(v) Using
consent in this instance is fraught with some challenges. We discuss some
below

  • The
    insertion of data sharing consent clauses in commitment/offer letters is a
    relatively recent development in the standard debt financing documentation
    adapted by Banks, meaning that a Bank may be unable to claim the benefit
    of this clause in respect of some Individual Obligors, whose financing or
    security agreements did not bear those clauses
  • The
    model data sharing consent clauses in standard commitment/offer letters
    usually allows the Bank to share credit information only with licensed
    credit bureaus or with regulators and not in newspapers or on social
    media.
  • It
    is unusual for an Individual Obligor to consent to a publication of
    his/her name in the newspapers as a debt recovery mechanism. Even if this
    were possible, such consent could be vitiated as per provisions of the
    NDPR. It’s important to note that the NDPR (as is the case with global
    data privacy regulations) sets a high standard for “consent”
    when used as a proxy for lawful basis. In order to justify processing based
    on “consent”, a Bank would have to, amongst others, show that
    any such “consent” was expressly given in the form of a clear
    and specific statement of consent; further that the consent was obtained
    without fraud, coercion or undue influence.  An Individual Obligor
    may be able to make a case of duress, if made to agree to an unbalanced
    data sharing clause.
  • Data
    sharing consent clauses are usually contained in offer letters and hardly
    in other standard financing or security agreements. In many cases,
    Individual Obligors who sign guarantee or indemnity agreements are not
    within the contemplation of the data consent sharing clauses contained in
    financing documents. The standard form of the security or indemnity
    agreements adapted by Banks do not typically contain these clauses.

 

vi)  
Another
option open to a Bank would be to rely on legitimate interest as
a lawful basis for complying with the Directive. The doctrine of legitimate
interest effectively allows data controllers, (the Bank, in this case) to
process personal data without the necessity of the consent of a data subject
(an Individual Obligor, in this case), where such processing is necessary
to protect the personal interest of a Data Controller or that of a third party.
Such personal interest can broadly include commercial interests of the Bank or
other broader societal interests. However, we note with some concern that there
is no categorical provision in the NDPR which identifies legitimate
interest
 as a lawful basis for processing personal data under the
NDPR. This means that technically, Banks may not be able to rely on legitimate
interest
 as a lawful basis for processing debtor information in the
manner contemplated by the Directive.

 

vii) A Bank may also consider relying on legal
obligation 
as a basis for processing debtor information in the manner
contemplated by the Directive. This principle allows the Bank to process
personal data without the necessity of the consent of an Individual Obligor,
where such processing is necessary to comply with a legal obligation.
To the extent that the publication of an Obligor’s personal information in the
newspaper is in furtherance a directive from the CBN, a Bank may seek to rely “legal obligation” as a lawful basis.  Although relying on legal
obligation
 may appear to be a more convincing “lawful basis”, the
important point to note is that the determination of the lawful
basis 
of an intended or an actual processing activity, requires
critical thought as there may be different considerations for different
categories of data, for the same processing activity and in the same data
controller organization. There could also be other legal considerations that go
to the root of data privacy activities carried out by regulated entities. For
instance, in this case, the author of the Directive, the CBN, is itself subject
to the NDPR and to regulatory supervision by NITDA on data privacy issues. On
that basis, the legality of the Directive can be challenged with a reasonable
prospect of success. In that event, public interest, a legal
doctrine also recognized as a lawful basis for processing an
Obligor’s personal data in the absence of consent will likely
determine where legal liability rests as well as the provisions of the CBN Act
and BOFIA [2]. The
CBN may have to demonstrate that the publication of the personal data of
Individual Obligors serves a public interest, notwithstanding the fact that the
Banks have the benefit of security.

 


Proshare Nigeria Pvt. Ltd.

 

Third
Party Liabilities?

Yes.
Newspapers or other media organizations who publish the personal data of
Individual Obligors may also be exposed to legal liability under the NDPR by
publishing the personal data of Individual Obligors. It’s particularly
important to note that the NDPR does not provide a specific journalistic
exemption for media publishers and their journalist employees. The practical
implication of this exclusion is that media organizations may not be able to
rely successfully on the premise that such publication was done in the
“public interest or in the exercise of press freedom, when faced with a legal
action from Nigerian claimants who claim that their personal rights have
been infringed by a media company or
journalist.

 

In
closing

The resolution of some of these issues are not
possible without definite administrative guidance from NITDA or a judicial
determination on the merits. It is particularly important to note there may
also be constitutional law implications. The NDPR specifically made provisions
mandating the interpretation of the NDPR in accordance with
constitutionally guaranteed principles and enforcement of fundamental rights.
This is significant for Banks and other data controllers for two primary
reasons; Firstly, this provision effectively changes the character of a data
privacy claim and subjects defendants in a data privacy litigation matter to a
higher legal standard in the form of a constitutional obligation.

 

In a sense, provides Nigerian courts with a new
canvass for analysing privacy rights as relates to the use and collection of
personal data by corporate entities. Secondly, Nigerian courts take fundamental
human rights issues very seriously and treat those issues speedily based on
special enforcement procedure and evidence rules. In practice, a great majority
of fundamental human right breach cases succeed in Nigerian courts.

 

It
helps to contemplate and resolve these issues early on.
 

 

Proshare Nigeria Pvt. Ltd.


About Author

Olubunmi
Abayomi-Olukunle is a partner and Lead Counsel at the Private Equity, Venture
Capital & Emerging Companies sector-focused, specialist investment &
finance law firm of Balogun Harold – www.balogunharold.com or
via e-mail: olu@balogunharold.com   

 

The above article was written on May 21, 2020 and titled “Re: The CBN Directive to Nigerian Banks on the Publication of the Names
of Delinquent Bank Debtors in the Dailies: Some Data Privacy Ramifications”.
Since then, we have published this judgment delivered by the courts For Publishing
Debtors List – Court Dismisses N5bn Libel Suit against THISDAY, Diamond Bank
 –
 July 17, 2020
 

 

Proshare Nigeria Pvt. Ltd.

 

Related Posts – NPLs and The Debt Burden

  1. Executive
    Summary: NPLs & Bank Debtors – The Case for a New Industry Approach
     – May
    14, 2020
  2. (PDF)
    NPLs & Bad Debtors: – The Case for a New Industry Approach
     – Debtors
    Africa, May 13, 2020
  3. Operational
    Guidelines on Global Standard Instruction (GSI)
     – CBN,
    Jul 15, 2020
  4. Memo To AMCON: Nigerian Tax Payers are not Responsible for Repayment
    of Bad Debt
     – Jul 23, 2020
  5. AMCON and
    Financial Services Debt Burden in Nigeria
     – Aug 17,
    2018
  6. Key
    Takeaways from the CBN GSI Guidelines and the Case for a New Approach
  7. CBN Issues
    Operational Guidelines on GSI to Facilitate Improved Credit Repayment
    Culture
  8. Debtors Africa:
    AMCON; Chike-Obi’s Alternative View
  9. Debtors
    Africa Launches Searchable Digital Database of Recalcitrant and Delinquent
    Debtors
  10. (PDF)
    – Coronanomics and the Nigerian Economy
     – Jun 06, 2020  

 Proshare Nigeria Pvt. Ltd.

Related to NPLs and Recovery

  1. Bank NPLs
    (25) – The Customer’s Options in a New Debt Order
  2. Bank NPLs
    (24) – Handling Bad, Delinquent and Recalcitrant Debtors via DiMR
  3. Bank NPLs
    (23) – The Case for a New Approach
  4. Bank NPLs
    (22) – Benchmarking Best Practice and International Debtors List
  5. Bank NPLs
    (21) – The Role and Place of Credit Bureaus and Rating Agencies in
    Recovery Efforts
  6. Bank NPLs
    (20) – A New Cottage Industry Emerges – Debt Factors and Loan Purchase
    Firms
  7. Bank NPLs
    (19) – Issues Around Nigerian Bank Debtors List
  8. Bank NPLs
    (18) – Understanding The Impact Of IFRS 9 On Selected Nigerian Banks
  9. Bank NPLs
    (17) – IFRS and Accounting Standards
  10. Bank NPLs
    (16) – The Place of Arbitration, Resolution or Debt Management
  11. Bank NPLs
    (15) – AMCON and Its Role in Debt Recovery
  12. Bank NPLs
    (14) – Regulatory Guidance, Conduct and Enablers
  13. Bank NPLs
    (13) – Impact on Growth of the Credit Market
  14. Bank NPLs
    (12) – Impact of NPLs on Income Trends
  15. Bank NPLs
    (11) – Technical Analysis on Banks’ NPLs – LDR
  16. Bank NPLs
    (10) – Technical Analysis on Banks’ NPLs – Leverage Ratio
  17. Bank NPLs
    (9) – Technical Analysis on Banks’ NPLs – Liquidity Ratio
  18. Bank NPLs
    (8) – Technical Analysis on Banks’ NPLs – NPL Ratio
  19. Bank NPLs
    (7) – Technical Analysis on Banks’ NPLs – Profitability
  20. Debtors Africa:
    AMCON; Chike-Obi’s Alternative View
  21. Bank NPLs
    (6) – Technical Analysis on Banks’ NPLs – Gross Earnings
  22. Bank NPLs
    (5) – How Banks Fared In 2018; Holding Up Against IFRS9 Tropical Winds
  23. Bank NPLs
    (4) – A Short History of Recovery Efforts – A Time Series Analysis
  24. Bank NPLs
    (3) – The State of NPLs
  25. Bank NPLs
    (2) – The Banking Industry and Its NPL Position
  26. Bank NPLs
    (DR 1) – The Case for a New Industry Approach
     

 

Proshare Nigeria Pvt. Ltd.

 

Data
Protection
/Privacy

1.      Mandatory Data Privacy
Compliance for Nigerian Companies – A Data Audit Offer
– Mar 02, 2020

2.      New Data Privacy
Compliance Considerations in Cross Border M and A Transactions Facing Africa
 –
 Oct 31, 2019

3.     
The Nigeria Data
Protection Regulation – Compliance Requirements

4.     
Report Sets Out
Governance of Key OTC Derivatives Data Elements
 – Oct 09, 2019

5.     
The Economics of
Data
 – Sept 23, 2019

6.     
How The General
Data Protection Regulation Will Affect Your Business

7.     National Data
Protection Regulations – Legal Alert

 Proshare Nigeria Pvt. Ltd.

 

Related News -Debtors & Recovery

1.              
SEPLAT Plc
Refutes Being Party to Cardinal Drilling Services Loan with Access Bank

2.             
O and O Networks
Limited and ETI Appeal Court of Appeal Judgement on Disputed Airtel Shares

3.             
AMCON Takes Over
Jimoh Ibrahim’s Prime Assets Over N69.4bn Debt

4.             
P and ID:
Nigeria’s Foreign Reserves Swell by $200m

5.             
P and ID Loses
Again as UK Court Orders Release of $200m Guarantee to Nigeria

6.             
N4bn Debt: Court
Grants AMCON’s Request to Take Over Firm’s Asset

7.             
Progress in the
P and ID Case

8.             
Nigeria Floors P
and ID as UK Court Grants Relief from $10bn Fine

9.             
AMCON: Is There
Scope for Improvement in Debt Recovery?

10.          
The CBN’s New
GSI Policy – Dangers Ahead and Recommendations

11.           
Accion MFB
Konnect Series: Experts Call For Clarity On Regulations for MFIs Under the GSI
Framework

12.          
Memo To AMCON:
Nigerian Tax Payers are not Responsible for Repayment of Bad Debt

13.          
For Publishing
Debtors List – Court Dismisses N5bn Libel Suit against THISDAY, Diamond Bank
 –
 July 17, 2020

14.          
Key Takeaways
from the CBN GSI Guidelines and the Case for a New Approach

 

 

Proshare Nigeria Pvt. Ltd.

Proshare Nigeria Pvt. Ltd.

Proshare Nigeria Pvt. Ltd.



Source: www.proshareng.com