Friday, 20 September

Court orders Bolt to pay ₵1.9m for data breach after passenger’s identity used in own ride request

Business
Bolt

The Adentan Circuit Court in Ghana has ruled against Bolt Holdings OU, ordering the company to pay GH₵1.9 million in compensatory damages after a passenger discovered his photo and name were being used by an unauthorised driver on the Bolt ride-hailing platform.

Justice Noah Adade, the plaintiff in the case, had booked a ride on August 1, 2022, only to find that his own identity was listed as the driver responding to the request. 

Upon the vehicle’s arrival, it was driven by Peter Walker, an employee of Justice Adade, who later admitted to stealing his employer’s identity to register as a Bolt driver.

Attempts by Justice Adade to seek compensation from Bolt Holdings OU were unsuccessful, leading him to file a lawsuit.

In a decision on September 18, 2024, Judge Sedinam Awo Kwadam found Bolt Holdings OU negligent in its duty as a data processor for Bolt Operations OU, the platform’s data controller. 

The court ruled that Bolt Holdings OU had failed to properly verify Peter Walker’s identity, allowing him to fraudulently use Justice Adade’s personal information.

The ruling pointed to breaches of Ghana's Data Protection Act, 2012 (Act 843), specifically sections 20, 21, 28, and 30, which outline requirements for securing personal data. 

The court stated that Bolt's omission of a thorough identity verification check for prospective drivers was a critical failure, and as such, the company was liable under Section 43(1) of the Act.

“The court finds Bolt Holdings OU negligent in its duty to ensure a liveliness identity verification process for driver applicants. As a result, the plaintiff is entitled to compensation for damages under the law,” the court stated.

In addition to the GH₵1.9 million in damages, Bolt Holdings OU was ordered to pay GH₵20,000 in legal costs. 

Bolt Ghana Limited, however, was cleared of any liability.

The court also issued directives for Ghana's Data Protection Commission to conduct a forensic audit of Bolt’s systems. 

The audit will assess the platform's compliance with data protection standards, and the court ordered Bolt to implement robust identity verification measures for all drivers registered by March 2024. 

Other ride-hailing services operating in Ghana were also instructed to undergo similar reviews to ensure the protection of personal data.

 

 

Source: Source: Classfmonline.com/Terkperkuor Puor