Legal experts and data privacy advocates have filed a suit against the Central Bank of Nigeria (CBN) at the Federal High Court, Kaduna, challenging the apex bank’s directive restricting bank customers to a single lifetime update of phone numbers linked to their Bank Verification Numbers (BVN).
The suit, instituted by the Incorporated Trustees of the Data Privacy Lawyers Association (DPLA), alongside Etisang Solomon, seeks to nullify the apex bank’s circular issued on March 12, 2026.
The directive, titled: “Addendum to the Revised Regulatory Framework for BVN Operations and Watchlist for the Nigerian Banking Industry,” introduces a “one-time” phone number update rule set to take effect from May 1, 2026.
According to the plaintiffs, the policy violates key provisions of the 1999 Constitution and the Nigeria Data Protection Act, particularly the constitutional right to privacy and legal guarantees for data accuracy and rectification.
They are asking the court to grant multiple reliefs, including a declaration that the directive is unconstitutional, an order nullifying the contentious clause, and a perpetual injunction restraining the CBN from enforcing the policy.
The applicants also seek a mandamus compelling the bank to review the framework in line with existing data protection laws.
In an affidavit supporting the suit, Christopher Yange warned that telecom operators routinely recycle or reassign phone numbers, making the policy impractical and risky.
He argued that customers could be permanently locked out of correcting sensitive financial data if their registered numbers are lost, stolen, or compromised after the single permitted update.
Lead counsel, Olumide Babalola, alongside Emmanuel Okpara and Frank Ijege, anchored the case on three major legal issues.
First, they argued that phone numbers linked to BVNs are critical security tools used for transaction alerts, One-Time Passwords (OTPs), and authentication processes, far beyond mere administrative data.
They cited judicial precedents, including the Court of Appeal ruling in Digital Rights Lawyers Initiative versus National Identity Management Commission, which affirmed that personal data falls under constitutional privacy protection.
Another case, Omotayo v Airtel Networks, was referenced to reinforce the protection of telecommunications data.
Secondly, the lawyers contended that limiting updates to a single instance effectively gives the CBN unchecked authority over citizens’ rights to correct their personal data, contrary to provisions of the NDPA.
They referenced Rebecca Temitope Bonje versus Guaranty Trust Bank Plc, where the court upheld the right to data rectification.
Read also:
- Link BVN to accounts for seamless payment of claims- NDIC urges bank depositors
- NDIC urges bank customers to link BVN for faster deposit reimbursement
- No hidden charges for Non-Resident BVN for diaspora Nigerians – CBN
On the third issue, the plaintiffs argued that the policy fails to account for real-life scenarios such as SIM loss, number recycling, network changes, or security concerns.
They maintained that the CBN could achieve its anti-fraud objectives through less restrictive measures, including enhanced identity verification and multi-factor authentication.
The suit further alleges that the directive was introduced without adequate stakeholder consultation or regulatory impact assessment, raising concerns about transparency and compliance with established data protection standards.
If successful, the case could significantly reshape Nigeria’s financial data policies and set a precedent for balancing security measures with fundamental privacy rights.
