In a landmark judgment reinforcing corporate accountability and data privacy rights in Nigeria, the Federal High Court, Abuja, has ordered Guaranty Trust Holding Company Plc (GTCO) to immediately cease sending unsolicited marketing communications to individuals who are not its customers.
The decision arose from an instance where a non-customer received promotional messages advertising “Fund 724,” an investment product managed by Guaranty Trust Fund Managers. The Court held that such unsolicited marketing, carried out without a lawful basis or the recipient’s consent, contravenes Nigeria’s data protection regime.
For years, the mobile phones and email inboxes of Nigerians have been inundated with relentless unsolicited marketing campaigns. Many corporate organisations operated on the assumption that merely possessing a person’s phone number or email address amounted to an unrestricted licence to market products and services. That era is rapidly coming to an end.
With the enactment of the Nigeria Data Protection Act (NDPA), 2023, coupled with a growing body of robust Federal High Court decisions, Nigeria’s data protection framework has entered a new phase of enforcement. Organisations are now under heightened legal obligations to ensure that every collection, processing, storage, and use of personal data is supported by a lawful basis and complies with the principles of transparency, fairness, accountability, and purpose limitation.
The recent judgment delivered by Justice Obiora Egwuatu in Abdulmalik Muhaimin Onimisi v. Guaranty Trust Holding Company Plc (GTCO) (delivered on 11 June 2026) sends an unmistakable message to corporate Nigeria. It establishes an important judicial precedent that companies can no longer collect, retain, exploit, or monetise personal data whose source, legal basis, or processing activities they cannot lawfully justify.
More significantly, the judgment reinforces the principle that direct marketing is not exempt from data protection obligations. Businesses must be able to demonstrate that they obtained valid consent or possess another recognised lawful basis under the NDPA before sending promotional communications. Failure to do so may expose organisations to regulatory sanctions, civil liability, reputational damage, and judicial intervention.
Anatomy of the Nigeria Data Privacy Act (NDPA) Framework:
Section 36 and the Right to Object
The cornerstone of recent data privacy litigation is the fundamental right of a data subject to control how their information is processed. The NDPA 2023 under Part VI explicitly outlines the Rights of a Data Subject, with Section 36 focusing entirely on the Right to Object.
- Section 36(1): Grants a data subject the absolute right to object to the processing of personal data relating to them. Once exercised, the data controller must immediately discontinue processing unless they can prove overriding legitimate grounds.
- Section 36(3) & (4): Deals explicitly with direct marketing. It stipulates that where personal data is processed for direct marketing purposes (including profiling), the data subject can object at any time, and upon doing so, the data shall no longer be processed for such purposes.
Crucially, Section 24(1) of the Act mandates that data must be processed fairly, lawfully, and transparently, requiring one of six valid legal bases (such as explicit consent or performance of a contract) to justify processing.
The GTCO Case: Eradicating Unsolicited Marketing to Non-Customers
In the Onimisi v. GTCO suit, the applicant (a non-customer) received direct marketing messages promoting “Fund 724”, an investment product managed by Guaranty Trust Fund Managers. Despite sending an explicit email objection to the bank demanding a cessation of marketing and disclosure of how his data was sourced, the backend infrastructure failed to comply.
The Federal High Court’s ruling dismantled several structural defenses common in corporate Nigeria:
1. Defining the Data Controller:
The court ruled that as a financial holding company directing promotional materials on behalf of its subsidiaries, GTCO qualified directly as a “Data Controller” under Section 65 of the NDPA.
2. Absence of Legal Basis:
Because the applicant had no prior banking or contractual relationship with the firm and had never granted consent, the court held that none of the lawful bases under the NDPA applied.
3.The Sourcing Disclosure Directive:
Beyond awarding damages, Justice Egwuatu ordered GTCO to disclose the exact source of the data. This strikes a massive blow against the underground market of illegal data brokers and unconsented third-party data transfers.
Connecting the Precedents: Araka v. Eat ‘N’ Go Ltd (The Domino’s Pizza Case)
The GTCO decision is not an isolated incident; it follows a robust line of anti-spam and data privacy enforcement. In early 2025, the Federal High Court in Abuja, presided over by Justice Emeka Nwite, delivered a landmark judgment in Chukwunweike Araka Akosa v. Ecart Internet Services Limited (Jumia Food) & Eat ‘N’ Go Limited (Domino’s Pizza).
In that case, the applicant had shared his data with Jumia Food strictly for the purpose of completing a food order. However, his data was subsequently ingested by Domino’s Pizza, which blasted him with unsolicited marketing texts addressed to “Hi Jumians”.
The court established two vital principles that complement the GTCO case:
- Purpose Limitation Rules: Under the NDPA, data processing must be strictly limited to the specific purpose for which it was originally collected. Consenting to a delivery order does not grant a perpetual license for promotional direct marketing.
- The “Opt-Out Button” is Not a Defense: Eat ‘N’ Go argued that their messages contained an “opt-out” mechanism. The court emphatically rejected this, ruling that the presence of an opt-out button does not cure an underlying illegality . If the initial data acquisition and processing lacked valid consent, the communication is unlawful ab initio.
Global Alignment: The Constitutional and Cross-Border Perspective
The judiciary has carefully tethered these data protection statutory infractions directly to the highest law of the land. In both Onimisi v. GTCO and Araka v. Eat ‘N’ Go, the courts have uniformly held that violating data protection statutes concurrently constitutes an infringement on the Right to Privacy guaranteed under Section 37 of the Constitution of the Federal Republic of Nigeria, 1999. While Section 37 is not absolute, the burden rests squarely on corporate institutions to establish a constitutionally justifiable reason to infringe upon a citizen’s informational privacy.
This evolving Nigerian jurisprudence mirrors global data protection standards, creating a unified cross-border front against corporate surveillance:
- European Union (GDPR): The strict stance of the NDPA aligns seamlessly with Article 21(2) of the EU General Data Protection Regulation (GDPR), which provides an absolute, un-overrideable right to object to direct marketing. Much like the Nigerian courts’ rejection of the “opt-out defense,” European regulators have long held that post-facto unsubscribe links cannot legitimize an initially illegal data harvest.
- United States (TCPA & CAN-SPAM): While the US operates on a more fragmented sector-specific approach, the Telephone Consumer Protection Act (TCPA) enforces heavy statutory fines per violation for unsolicited automated telemarketing and texts. However, Nigeria’s framework jumps ahead by actively mandating the exposure of backend data brokers, an area where US federal law is still heavily debating comprehensive transparency.
- United Kingdom (UK GDPR & PECR): Under the Privacy and Electronic Communications Regulations (PECR), the UK strictly enforces the “soft opt-in” rule, meaning businesses cannot market to individuals unless they obtain their details during a direct sale of a product or service. The GTCO judgment effectively establishes this exact threshold in Nigeria: if there is no prior business relationship, unsolicited communication is a legal landmine.
Corporate Implications: What Businesses Must Do Immediately
The combined effect of the NDPA 2023, stronger global enforcement, and the Federal High Court’s proactive approach means that aggressive, unsolicited marketing has become a significant legal risk. Businesses now face substantial penalties from the Nigeria Data Protection Commission (NDPC), including fines of up to 2% of annual gross revenue, alongside increasing exposure to civil litigation.
To remain compliant, organisations must audit the source of all personal data and delete information obtained without verifiable consent, immediately honour opt-out requests by stopping all direct marketing, and ensure that personal data collected for transactions is not repurposed for marketing unless the individual has provided explicit consent.
The message from regulators and the courts is clear: data protection is no longer a box-ticking exercise. Corporate accountability, transparency, and lawful data processing are now essential legal obligations.
References:
- Nigeria Data Protection Act 2023 (NDPA).
- Abdulmalik Muhaimin Onimisi v Guaranty Trust Holding Company Plc (FHC Abuja, 11 June 2026).
- NDPA 2023, pt VI.
- ibid, s 36(1).
- ibid, s 36(3)–(4).
- ibid, s 24(1).
- ibid, s 65.
- Chukwunweike Araka Akosa v Ecart Internet Services Limited (Jumia Food) & Eat ‘N’ Go Limited (Domino’s Pizza) (FHC Abuja, March 2025).
- Constitution of the Federal Republic of Nigeria 1999, s 37.
- Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1 (GDPR) art 21(2).
- Telephone Consumer Protection Act, 47 USC § 227 (1991) (TCPA).
- Privacy and Electronic Communications (EC Directive) Regulations 2003, SI 2003/2426 (PECR).
