Bolt Holdings OU, the data processor for the ride-hailing platform Bolt, has been ordered by the Circuit Court in Adentan to pay a lecturer and chief executive officer of a software solutions company, Justice Noah Adade, an amount of GHC 1.9 million as damages for identity theft.
This request came after the court presided over by Her Honour Sedinam Awo Kwadam, realized that the company had failed to detect the theft of the lecturer’s identity and its final use by a driver.
The plaintiff, Justice Noah Adade, said that he ordered a Bolt ride on his phone on 1 August, 2022 and found his own photograph and details being used for the driver who was responding to pick him up.
To his surprise, it was his own employee, one Peter Walker, who was driving the vehicle when it arrived.
The plaintiff said Peter Walker confessed to stealing his identity and successfully registering himself as a driver on the Bolt app in 2022.
The plaintiff’s engagement with the second defendant through his lawyers yielded no fruitful results by way of compensation hence, the instant suit.
The lecturer has since then, sued Bolt Ghana Limited as the first defendant and Bolt Holdings OU as the second defendant.
The plaintiff, asked the court to find that Bolt had been negligent in failing to verify the identity of the driver, hence allowing the identity theft to take place.
The court after reviewing found out that Bolt was required by Ghana’s Data Protection Act to undertake a liveliness identity verification check when registering a prospective driver.
With this not done, the court said Bolt’s failure to undertake this check amounted to a breach of its duty of care owed to the data subject (plaintiff).
Her Honour Mrs Kwadam, in her judgment dated September 18, 2024, also agreed that the failure on the part of the defendant amounted to non-compliance with Section 20 of the Data Protection Act, which bars data processors from processing personal data without the prior consent of the data subject unless the purpose for which the personal data is processed is necessary for the purpose of a contract to which the data subject is a party.
This, the court said, subjected the plaintiff to emotional distress and trauma from seeing himself as a Bolt driver operating over an uncertain period of time.
The court added that this amounted to damage to his reputation, forcing him to expend resources to seek legal redress while dismissing claims by Bolt that it had acted diligently and took reasonable care.
Consequently, the court held that the plaintiff succeeded in his action and ordered Bolt to pay GHS 1.9 million as compensation.
In addition to the compensation, the court also directed that an additional GHC 20,000 be paid to the lecturer for his legal fees.
The court further directed the Data Protection Commission to ensure a forensic audit of Bolt’s systems and database to check the accuracy of the identity of all its drivers up until March 2024.
The commission is also to extend the audit to all other ride-hailing platforms in the country.
