By way of introduction to the issue of the legal basis of disclosing the information of debtors by Banks (which amounts to processing of such information), it is pertinent to state that it remains to be settled whether or not the fact of indebtedness is information personal to a debtor.
This is because the information is one jointly owned by the debtor and the creditor upon which they both have a right to use. More in the same way the name of a wife is information which the husband can use as a reference to her being his wife without needing to get consent. It is shared information not personal information. This is because the information itself is in relation to another entity.
For further clarity, the information that a debtor is indebted to a creditor is the economic information of the creditor as much as it is that of the debtor; and it is not information personal to anyone of them.
However, the issues raised in the article will be dealt with on the premise, without concession, that the fact and amount of indebtedness is economic information personal to the debtor.
It is herein argued that there are three (3) lawful basis for disclosing (processing) the information of a debtor vis:
- First, processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract;
The contract for obtaining the loan is a contract to which the data subject is a party. By entering into the contract, every personal information supplied can be processed and used for the purpose of performing the contract. It is important to note that the performance of the contract is not complete at the point of issuing the loan, which is only one leg of the contract, but is only complete at the point at which the loan is repaid.
Consequently, the bank is at liberty to use the data and information of the debtor for every action it needs to help it perform the other leg of recovering the loan. These actions can include transmission to a newspaper, a debt recovery agency, and a legal practitioner.
By extension, a third party is also allowed to process the information for the purpose of performing the contract which the data subject is a party to. It is important to note here that it is the data subject who is required to be a party to the contract and not the processor. Any other third party can process the information to the end that the contract might be performed. The act of publishing the names of the debtor, filing an application in court, or otherwise doing any action to recover the said debt is an action necessary for the performance of the loan contract provided that the methods of recovering the debt has not been limited by said contract.
- The second basis for processing the said information is because processing is necessary for compliance with a legal obligation to which the Controller is subject.
This is a rather glaring one as the banks are subject to regulation of the Central Bank of Nigeria as provided by the BOFIA Act. Consequently, banks are duty bound to comply with any regulation of the Central Bank to the extent that it does not conflict with any other existing law. It is important here to state that the regulation of the Central Bank does not conflict in any way with the NDPR as what the CBN requirement that banks publish the names of delinquent debtors does is to create a legal obligation which is anticipated by the NDPR thus providing an exception for banks if they had been otherwise unable to process such data.
The fact that the author of the directive, the CBN, is itself subject to the NDPR and to regulatory supervision by NITDA on data privacy issues does not go to the root of whether the CBN can create a legal obligation to process information on its subjects. As an illustration of this point, the National Assembly and Supreme Court are also subject to the NDPR and regulatory supervision on data privacy issues by the NITDA, it would be ridiculous to state that they cannot create a legal obligation to process data.
The NITDA is not empowered to determine exactly what information any particular body can process, but only to make provisions on the circumstances under which processing can be done.
Lawful processing by virtue of a legal obligation is present in the NDPR in order that government agencies would not be hampered in the discharge of their legal duties and functions. The NDPR is not a super enactment that can be elevated to the position of the Constitution. Was there a legal obligation created? Yes. Is the creator of the obligation authorised to create such an obligation? the answer is also in the affirmative. Thus, it is clear that information of debtors can be processed.
- The third basis for processing under the circumstances is that it is necessary for the performance of a task carried out in the public interest or in exercise of official public mandate vested in the controller. This is because the issue of delinquency in the banking sector has become a systemic issue with serious implication for the banking sector and economy at large.
Recall that the issue of non-performing loans was so bad that the Asset Management Company of Nigeria (AMCON) had to be created to deal with the problem. The Debtors Report particularly does an analysis of the issue of NPLs. An Executive Summary of the report is available here. Thus, the need to tackle the issue of non-performing loans is one of public interest.
Publishing the names of delinquent debtors is also of public interest as it aids members of the public in discerning who to go into business with. The need to rid the banking sector of delinquent debts is therefore a matter of public interest and is a lawful basis upon which information of debtors can be published.
Conclusion
In summary it is important to note that the era of hiding behind the cloak of anonymity for debtors is past and a new industry approach has been adopted to aid in unmasking the character of delinquent debtors and thus reduce the exposure of the banking sector and indeed the economy to them.
The laws are in order and the NDPR is not a clog in the administration of this new credit regime.
