Employee Privacy Breach: Industrial Court Fines Lafarge N2 million

LAGOS — The National Industrial Court in Lagos has ordered cement manufacturer Lafarge Africa Plc to pay ₦2 million in damages to a former staff member. Justice Ikechi Gerald Nweneka ruled that the company illegally retained and utilized the personal details of Mr. Kehinde Adeniyi Johnson after his 2019 exit. In the judgment delivered on February 17, 2026, the court found Lafarge guilty of breaching Section 37 of the 1999 Constitution. Consequently, the firm must permanently delete the claimant’s identity from all its procurement platforms and internal servers. This landmark decision highlights the growing legal risks for corporations that fail to purge sensitive personnel data. While it is true that Lafarge attributed the error to a system glitch, the judge deemed the oversight reckless.

The claimant, Mr. Johnson, initiated Suit No. NICN/LA/60/2022 after discovering his name remained on official purchase orders. He allegedly endured years of harassment from logistics agents and suppliers who believed he still managed Lafarge’s consignments. Furthermore, the court heard testimony regarding a botched shipment from India that led to a traumatic armed robbery encounter. Although Johnson sought ₦50 million in damages for emotional distress, the judge applied the principle of proportionality. Indeed, the court clarified that its jurisdiction covers all disputes arising directly from a previously active employment relationship. For this reason, the judge dismissed Lafarge’s preliminary objections regarding the admissibility of digital communications as evidence.

Lafarge maintained that it deactivated Johnson’s official email and notified external vendors of his disengagement in 2019. In a related development, the defense team argued that claims involving emotional distress fell outside the Industrial Court’s mandate. Granted, several secondary claims regarding human dignity and aggravated damages were dismissed due to a lack of evidence. However, the judge upheld the claim for intentional infliction of emotional distress because the company ignored formal warnings. Notably, the court noted that the Nigeria Data Protection Act (NDPA) mandates the prompt erasure of data once the purpose ends. Above all, this ruling serves as a warning to the private sector regarding the sanctity of digital privacy.

Significantly, the judgment compels Lafarge to deactivate any pre-generated procurement codes that still bear the claimant’s personal mobile number. Subsequently, HR departments across Nigeria must now audit their automated systems to ensure they do not “ghost” former employees. Although the ₦2 million fine appears modest, it represents a significant victory for individual privacy rights against corporate negligence. For all employees in Nigeria, the message remains clear: your data is your property. Therefore, the legal precedent established here will likely trigger a wave of similar data-related litigations in the coming months.

Currently, the focus of the industry shifts to how Lafarge and other employers will overhaul their ERP systems. As a result of this ruling, the cost of administrative “system malfunctions” has just become more expensive.