Court orders Bolt to pay ₵1.9m for data breach after passenger’s identity used in own ride request

The Adentan Circuit Court in Ghana has ruled against Bolt Holdings OU, ordering the company to pay GH₵1.9 million in compensatory damages after a passenger discovered his photo and name were being used by an unauthorised driver on the Bolt ride-hailing platform.
Justice Noah Adade, the plaintiff in the case, had booked a ride on August 1, 2022, only to find that his own identity was listed as the driver responding to the request.
Upon the vehicle’s arrival, it was driven by Peter Walker, an employee of Justice Adade, who later admitted to stealing his employer’s identity to register as a Bolt driver.
Attempts by Justice Adade to seek compensation from Bolt Holdings OU were unsuccessful, leading him to file a lawsuit.
In a decision on September 18, 2024, Judge Sedinam Awo Kwadam found Bolt Holdings OU negligent in its duty as a data processor for Bolt Operations OU, the platform’s data controller.
The court ruled that Bolt Holdings OU had failed to properly verify Peter Walker’s identity, allowing him to fraudulently use Justice Adade’s personal information.
The ruling pointed to breaches of Ghana's Data Protection Act, 2012 (Act 843), specifically sections 20, 21, 28, and 30, which outline requirements for securing personal data.
The court stated that Bolt's omission of a thorough identity verification check for prospective drivers was a critical failure, and as such, the company was liable under Section 43(1) of the Act.
“The court finds Bolt Holdings OU negligent in its duty to ensure a liveliness identity verification process for driver applicants. As a result, the plaintiff is entitled to compensation for damages under the law,” the court stated.
In addition to the GH₵1.9 million in damages, Bolt Holdings OU was ordered to pay GH₵20,000 in legal costs.
Bolt Ghana Limited, however, was cleared of any liability.
The court also issued directives for Ghana's Data Protection Commission to conduct a forensic audit of Bolt’s systems.
The audit will assess the platform's compliance with data protection standards, and the court ordered Bolt to implement robust identity verification measures for all drivers registered by March 2024.
Other ride-hailing services operating in Ghana were also instructed to undergo similar reviews to ensure the protection of personal data.
Trending Business
INSEAD graduates engage GIPC on Ghana’s investment opportunities
03:35Anlo chiefs pay courtesy call on NPA chief executive
14:49BoG to ban wilful loan defaulters from credit for five years
11:34Abossey Okai Spare Parts dealers mourn victims of August 6 helicopter crash
15:16Madina Job Centre signs MOU to provide loans for young MoMo entrepreneurs as part of InstaBusiness project
14:50NPA warns against unlicensed petroleum storage and marketing
10:14Coconut Federation-Ghana mourns eight victims of helicopter crash
09:31GIPC board chairman vows to reposition Ghana as premier investment destination
11:20ORC marks awareness week to educate public on new company registration codes
02:41Atuabo Gas Processing Plant to undergo scheduled maintenance from August 16–30
15:25