Incorporated Trustees of the Data Privacy Lawyers Association (DPLA), a group of legal experts and data privacy advocates and Etisang Solomon have filed a fundamental rights enforcement suit at the Federal High Court, Kaduna Judicial Division, against the Central Bank of Nigeria (CBN).
The suit, officially stamped by the court on April 8, 2026, seeks to nullify a CBN circular that restricts bank customers to a single lifetime amendment of phone numbers linked to their Bank Verification Numbers (BVN).
The circular titled “Addendum to the Revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watchlist for the Nigerian Banking Industry,” was issued by the apex bank on March 12, 2026.
According to the provisions of clause (c) in that document, any amendment to phone numbers linked to a BVN shall be allowed only once, with the new provisions set to take effect from May 1, 2026.
Reacting to the CBN directive, legal experts and data privacy advocates argue that this timeline and the restriction itself violate multiple provisions of the 1999 constitution and the Nigeria Data Protection Act (NDPA).
They are seeking nine reliefs from the court, including declarations that the circular violates section 37 of the constitution regarding the right to privacy, Section 24(1)(e) and 34(1)(c) of the NDPA, along with orders nullifying the impugned clause, a perpetual injunction restraining the CBN from enforcing it, and a mandamus directing the CBN to review and amend the circular.
In an affidavit sworn on behalf of the applicants, Christopher Yange highlighted the practical dangers of the policy, noting that telecommunications providers frequently recycle, deactivate, or reassign numbers that have been lost or stolen.
He cited a report from the Foundation for Investigative Journalism (FIJ) to demonstrate that phone numbers are not static assets.
Furthermore, the legal experts and data privacy advocates also contend that if a customer’s number is compromised after their single permitted update, they would be permanently barred from correcting their financial records, leaving sensitive data such as transaction alerts and One-Time Passwords (OTPs) vulnerable to interception by third parties.
Olumide Babalola, Emmanuel Okpara, and Frank Ijege of Olumide Babalola LP, applicants’ counsel, in a detailed written address spanning over 12 pages, framed the case around three core legal issues.
They argued on the first issue that a phone number associated with a BVN transcends basic administrative data, serving instead as a vital conduit for financial security, including transaction notifications, OTPs, and authentication protocols.
To bolster this claim, they pointed to several legal precedents.
Among these was the 2021 Court of Appeal ruling in Digital Rights Lawyers Initiative v National Identity Management Commission (NIMC), which affirmed that constitutional privacy rights encompass the safeguarding of personal data.
Additionally, they referenced the 2025 decision in Omotayo versus Airtel Networks, where the Court of Appeal reiterated that the privacy of telecommunications and call records is protected under the constitution.
On the second issue,they argued that by permitting only a single update, the CBN essentially grants itself a permanent power of veto over a citizen’s right to correct their data, a move that directly contradicts the clear language of the law.
To support this claim, they referenced the 2024 High Court of Lagos ruling in Rebecca Temitope Bonje versus Guaranty Trust Bank Plc, which upheld the legal requirement for data precision and the right to rectification as mandated by the NDPA.
Concerning the third legal point, the applicants argued that the single-amendment restriction serves as a rigid, all-encompassing mandate.
They noted that it fails to consider valid circumstances like the loss or physical damage of a SIM card, switching service providers, the recycling of phone numbers, or moving to a new line for personal safety.
The legal team maintained that the apex bank could achieve its anti-fraud objectives through less restrictive measures, such as advanced identity checks, multi-factor authentication, or short-term account freezes for security verification, without compromising the fundamental rights of bank customers.
The affidavit further claims the CBN’s directive lacks good faith, citing a lack of public evidence or regulatory impact assessments.
It also highlights a failure to consult stakeholders across the banking, telecom, and data protection sectors, the absence of a structured appeal process for device loss or errors, and a general lack of alignment with the NDPA.
The lawsuit, pursues several key reliefs: a declaration that the circular is unconstitutional and breaches the NDPA; the nullification of clause (c) of the addendum; and a perpetual injunction against the phone number amendment limit.
Furthermore, it seeks a mandamus to compel the CBN to revise the circular in line with constitutional and data accuracy standards, alongside an order for the bank to implement a flexible and verifiable update framework.
