Published September 21, 2024
In the Adentan Circuit Court, Justice Noah Adade (the plaintiff) successfully made a case of negligence against Bolt Holdings OU for non-compliance with the Data Protection Act, 2012 (Act 843).
Plaintiff established that his identity was used by his employee, Peter Walker, to register with Bolt Holdings OU as a driver. The plaintiff claims to have discovered this on or about the 1st of August, 2022, when he used the Bolt app to order a ride. Upon arrival, the driver turned out to be his employee, Peter Walker.
The Plaintiff’s case:
The Plaintiff’s case was that Bolt Holdings OU breached the duty of care owed him in processing his personal data without his consent thereby violating sections 20, 21, 28, and 30 of the Data Protection Act, 2012 (Act 843). These sections collectively place a duty of care on data controllers and/or data processors in processing data. Thus, they are required under law to obtaining direct consent, secure the integrity of personal data, and implement security measures. By law, a data processor is also required to conduct a “liveness” identification verification check during the digital verification process.
At the time, the plaintiff’s employee used his identity and registered on the Bold platform, Bolt Holdings OU did not have such a verification process as part of its digital registration system.
Judgment of the court:
Having found that Bolt Holdings OU owed a duty of care to the plaintiff and breached that duty, the court awarded damages against Bolt Holdings OU in the amount of ¢1.9 million, along with ¢20,000.00 in costs.
