Bolt Holdings OU, owners of the ride-hailing platform Bolt, have been ordered by the Adentan Circuit Court to pay GHC 1.9 million in compensatory damages to a lecturer, Justice Noah Adade, after a shocking case of identity theft allowed an imposter to register on Bolt’s platform as a driver using his personal information.
According to a court judgment that was delivered on September 18, 2024, Justice Adade booked a Bolt ride on August 1, 2022, only to find that the driver responding to his request was using his own name and photograph. When the ride arrived, it was driven by Peter Walker, who turned out to be Justice Adade’s employee. Walker admitted to stealing Adade’s identity and fraudulently registering himself as a Bolt driver, using Adade’s personal details without his consent.
Following this discovery, Justice Adade sought compensation from Bolt Holdings OU through his legal team. However, after the company refused to settle the matter, he proceeded to take the case to court.
The court presided over by Judge Sedinam Awo Kwadam, found Bolt Holdings OU liable for negligence in failing to perform adequate identity checks during the driver registration process.
The court noted that the company’s failure to implement a “liveliness identity verification check” allowed Walker to register using stolen information, violating several provisions of Ghana’s Data Protection Act, 2012 (Act 843).
“D2 was negligent towards the Plaintiff for failing to undertake a liveliness identity verification check as part of its digital identity verification process during the processing of the personal data belonging to the Plaintiff, the data subject, when the Plaintiff’s identity thief requested to be registered by D2 to become a driver on the Bolt Platform/App,” the court said.
Bolt Holdings OU, as the data processor for Bolt Operations OU (the data controller), was also found guilty of breaching Sections 20, 21, 28, and 30 of the Data Protection Act, which mandates the protection of personal data and proper identity verification for service providers handling sensitive user information.
In its ruling, the court awarded Justice Adade GHC 1.9 million in compensatory damages, noting that Bolt’s negligence caused harm to the plaintiff.
Additionally, Bolt Holdings OU was ordered to pay GHC 20,000 in legal costs. However, the court cleared Bolt Ghana Limited of any liability in the case.
Impact on Data Protection
The court emphasized the need for all organizations handling personal data to maintain high standards of protection and to implement strict identity verification protocols. It warned that lax procedures put ordinary citizens at risk of identity theft and other violations, as seen in Justice Adade’s case.
“All organisations, big or small who have the privilege of processing the personal data of people must live up to the high standard of care expected of them by statute and general public safety policy in order to prevent unscrupulous people from using their platforms and systems to place the ordinary citizens of Ghana at risk of their identities being used for purposes they never consented to or had any prior knowledge of,” the judge said in additional comments.
The Data Protection Commission has also been urged to rise up to the occasion and protect citizens from becoming victims of data breaches.
