Court Orders Lafarge To Pay Employee Damages Over Data Breach

The Lagos Division of the National Industrial Court has ordered Lafarge Africa to pay one of its employees, Kehinde Johnson, N2million in damages for unlawfully using his personal data years after his employment ended.

Justice Ikechi Nweneka granted the order after he held that Lafarge violated the claimant’s privacy rights by continuing to retain and use his name and contact details in official purchase orders even after he had left.

Johnson filed the suit in February 2022, seeking declarations that the company’s actions were unlawful and fraudulent, and that they caused emotional distress, along with N50 million in damages.

He told the court that, despite ending his employment in November 2019, he continued to receive calls, emails, and WhatsApp messages regarding Lafarge consignments.

The claimant averred that his contact details were still listed as the company’s buyer globally.

He recounted an incident where he accepted a shipment from India after being contacted, but was refused access to deliver and was later attacked by armed robbers.

He argued that continued use of his data exposed him to risks and emotional trauma.

However, in his counter-affidavit, Lafarge Africa Plc denied any wrongdoing, attributing the issue to a computer system glitch.

The company argued that it had disabled the claimant’s official email and access to its servers after his departure and had informed suppliers about his disengagement.

It also argued that the National Industrial Court lacked jurisdiction over claims for tort and emotional distress.

The court dismissed Lafarge’s objections to certain evidence, ruling that emails and chats were admissible as direct communications involving the claimant.

The court also held that the case was within its jurisdiction, as it arose from employment relations and was not a fundamental rights case.

The judge held, “The evidence showed Lafarge used the claimant’s name and contact details post-employment, violating the Nigeria Data Protection Act, 2023, and the constitutional right to privacy.

The court agreed with the emotional distress claim, noting Lafarge’s conduct was reckless even after being notified by the claimant’s lawyers.

However, it rejected other claims, such as claims for damages for human dignity and for tort interference.

Though initially seeking N50 million, the claimant was awarded N2 million, aligned with statutory limits and fairness considerations.

The court further ordered Lafarge to permanently delete the claimant’s personal data from its systems and deactivate any codes with his name.