[2024] UGCommC 99

## 5 **THE REPUBLIC OF UGANDA**

## **IN THE HIGH COURT OF UGANDA AT KAMPALA**

## **(COMMERCIAL DIVISION)**

## **MISCELLANEOUS APPLICATION NO. 1194 OF 2023**

**(Arising out of Civil Suit No. 0867 of 2022)**

## 10 **NADYA DIMITROVA MILEVA ::::::::::::::::::::::::::::::::: APPLICANT**

## **VERSUS**

# **KCB BANK UGANDA LIMITED :::::::::::::::::::::::::::::: RESPONDENT**

## **Before: Hon. Lady Justice Harriet Grace Magala**

## **RULING**

## 15 **Background**

The Applicant is a customer of the Respondent and a holder of account No. *2291834770* from which Ugx 121,025,185/- was purportedly and collectively withdrawn without her consent on 27th August 2022, 28th August 2022, and 29th August 2022 through the E-service banking service of the Respondent.

20 The Applicant sued the Respondent for among others, breach of the banker customer relationship and negligently permitting the illegal and unauthorized transactions on her account and issuing to her an illegal bank statement.

The Applicant now seeks for production of an internet banking policy, believed to be in the possession, control and custody of the Respondent which is deemed

25 relevant to the issues that are to be heard and determined by this Honorable

Court in the main suit.

- 5 This Application is brought under **Article 126 of the Constitution of Uganda**, **Section 33 of the Judicature Act**, **Section 98 of the Civil Procedure Act**, **Order 10 Rules 12, 19, 24 of the Civil Procedure Rules** and **Order 11 Rule 1 & 2 of the Civil Procedure Rules S. I 71-1**. The Applicant seeks orders for the discovery/production of a certified true copy of the internet banking policy that - was in use by Respondent on the 22nd March 2021, 27th August 2022, 28th 10 August 2022, 29th August 2022 and 30th August 2022 ; and orders directing the Respondent to deliver and or otherwise hand over a certified true copy of the internet banking policy that was in use by the Respondent 22nd March 2021, 27th August 2022, 28th August 2022, 29th August 2022 and 30th August 2022 to the - 15 court for inspection for the purpose of deciding whether or not it is a privileged/confidential document.

The Application is based on following grounds:

- a) That the Applicant is a customer of the Respondent with account number 2291834770 and signed up for e-service banking; - b) That on the 27th day of August 2022 and on 29 20 th August 2022, *Ugx. 121,925,185/-* was illegally and without the Applicant's consent withdrawn from her bank account using the e-service banking services of the Respondent after the Applicant had instructed the Respondent to block her account; - 25 c) That the Applicant sued the Respondent for among others breach of the banker-customer relationship and for acting negligently in permitting the above unauthorized withdraws from her account and for issuing to her a false bank statement; - d) That the internet banking policy that was in use by the Respondent on the 22nd day of March 2021, 27th August 2022, 28th August 2022 and 30th 30 August 2022 is one of the documents that governed the e-service banking relationship between the parties;

- 5 e) That the internet banking policy is relevant to the issues that are to be heard and determined by the honorable court, for instance whether the Respondent acted negligently and or in breach of the banker-customer relationship and or is liable for issuing a false bank statement to the Applicant; - 10 f) That the said internet banking policy exists and the same is in the possession, control and or custody of the Respondent; - g) That the orders of discovery are specific and limited to the internet banking policy in place at the time that the illegal and unauthorized withdraws complained about in the main suit occurred and at the time 15 when the internet/e-banking relationship between the parties started; - h) That the Applicant requested the Respondent to avail her the said internet policy but it refused to comply with the request on account that the internet banking policy is confidential whereas it is not; and - i) It is in the interest of justice that this Application is granted.

## 20 **Affidavit in support of the Application**

The Applicant deposed that:

- a) On the 24th of December 2020, she opened a bank account No. 2291834770, with the Respondent and on the 22nd of March 2021, she signed up for E-service Banking services; - 25 b) The Internet Banking Policy that was in use by the Respondent on the 22nd day of March 2021 is one of the documents that govern the E-service banking relationship of the parties; - c) On the 27th day of August 2022 and on 29th August 2022, Ugx. 121,925,185/- were illegally and without her consent withdrawn from her 30 bank account using the e-service banking services of the Respondent after she instructed the Respondent to block her account;

5 d) At the material time, the Respondent had an internet banking policy that was in use;

e) She sued the Respondent for among others breach of the banker-customer relationship and for acting negligently in permitting the unauthorized withdraws from her account and for issuing to her a bank statement 10 containing inaccurate/false entries;

- f) One of the agreed issues between the parties for determination by the court is whether the Respondent was negligent in allowing the withdraws complained about; - g) She is informed by her lawyers, that the internet banking policy that was in use by the Respondent on the 22nd March 2021, 27th August 2022, 28th 15 August 2022, 29th August 2022 and 30th August 2022 is relevant to the issues that are to be heard and determined by the Honorable Court; - h) The Respondent in her trial bundle includes an Investigation Report that refers to an internet banking policy, which shows that the same is in 20 existence and in the possession and control of the Respondent; - i) She is reliably informed by her advocate Sebbowa Francis that is important for her legal team to cross examine the Respondent on the said internet policy; - j) The orders for discovery that she has applied for are specific and limited 25 to the internet banking policy in place at the time when the illegal and unauthorized withdraws complained about in the main suit occurred and at the time when the internet/e-banking relationship with the Respondent started; - k) The Respondent does not dispute the existence of the Policy but 30 maintains that it is confidential; - l) She is reliably informed by her advocate that the said internet policy is not confidential, and it does not contain any information pertaining to the

5 Respondent's customers such as account numbers, account names, account passwords and or other transactions of such customers;

- m) She is reliably informed by her advocate, Sebbowa Francis that in order to determine whether the internet banking policy is confidential it is pertinent that the orders for it be produced to the court for that purpose be granted; - 10 n) The internet policy is not privileged and or otherwise protected by the law against discovery and or production; and - o) It is in the interest of justice that this Application is granted.

## **Affidavit in Opposition to the Application**

The affidavit was deposed by Najjemba Leila Linda, a Legal Manager of the 15 Respondent. She averred that:

- a) The Application was merely a fishing expedition and does not show what it is in the internet banking policy that is relevant to the Applicant's case and specifically the Application does not say what in the policy is required to show a breach of banker-customer relations, negligence, or 20 false statements; - b) Whereas the Investigation Report referred to an internet Banking policy, there is no document called an internet banking policy. Rather the word 'policy' was used loosely to refer to the Terms and Conditions for E-Banking; - 25 c) The said Internet Banking Policy is irrelevant to the Applicant/Plaintiff's case as the relationship between the Applicant/Plaintiff and Respondent/Defendant was specifically governed by the Terms and Conditions for E-Banking and the Internet Banking policy adds nothing to the case and even if there was such an internet Banking policy, it would be 30 a unilateral document used for internal purposes, and the Applicant is not privy to it and cannot be relied on to found any cause of action;

Page 5 of 16

- 5 d) There is no sole internet Banking policy, the Bank has numerous documents that guide internally how internet banking is to be conducted and these documents are for internal use and are therefore confidential; and - e) Any potential loss to be suffered by the Plaintiff from non-disclosure is 10 mitigated by the fact that the relationship between the Plaintiff and the Defendant is specifically governed by the Terms and Conditions for E-Banking.

## **Affidavit in Rejoinder**

The Applicant in rejoinder deposed that:

- 15 a) The documents comprising the internet policy of the Respondent are relevant for demonstrating the exact scope and or nature of duty owed to her; - b) The said documents which comprise and or make up the internet policy are relevant in determining whether or not the Respondent was negligent - 20 and or acted in breach of its obligations to her as her banker; and - c) Her request/Application is specific and limited to only documents comprising/making up the internet policy of the Respondent.

## **Representation and Hearing.**

The Applicant was represented by M/s Ssebowa & Co. Advocates while the

25 Respondent was represented by M/s AF Mpanga Advocates. Both parties filed their respective submissions which I have duly considered.

Page 6 of 16

## 5 **Submissions**

## **Applicant's submissions**

It was submitted for the Applicant that the documents comprising the internet policy were relevant in as far as they contained the steps to be taken by the Respondent's employees to detect fraudulent transactions and how to respond

- 10 thereto. That the said policy was central in determining whether the Respondent was negligent or not. Learned counsel for the Applicant cited and relied on the case of *John Kato v Muhlbauer AG and another HCMA No. 175 of 2011* to assert that Applications of this nature require that the documents are in the possession and or custody of the Respondent, the document must be relevant to - 15 the issue to be tried and discovery should not be used as a fishing expedition by the Applicant to try and build up a case which he is not sure of.

Regarding the possession and custody of the internet policy by the Respondent, counsel relied on paragraph 7 of the grounds of this Application and paragraphs 14,15,18 and 19, and Annexture B of the Affidavit in Support of this

20 Application. He concluded that it was not disputed that the said policy comprised of several documents was in the possession and custody of the Respondent.

He submitted that the Bank's policy on internet banking was relevant because of the agreed issues for trial was whether the Respondent was negligent in

- 25 allowing the illegal withdraws. That it is trite that for one to establish the tort of negligence, the claimant must prove that the defendant owes the claimant a duty of care, the defendant has acted in breach of that duty and as a result, the claimant has suffered damage as consequence of the defendant's breach. The documents comprising the internet policy of the Respondent are relevant for 30 demonstrating and or showing the exact scope and or nature of duty owed to the - Applicant. For instance, what instructions are given to the Respondent's

Page 7 of 16

5 employees or measures in place to detect the fraudulent transactions so as to safeguard the Applicant's bank account.

Further submission was made that to defend and or respond to the Investigation Report and in spirit of fair hearing by the Respondent, it shall be pertinent to cross examine the Respondent on the internet banking policy. That the

10 Respondent cannot approbate and reprobate by stating that the internet policy showed that it was not to the Applicant and thereafter stated that the policy was confidential for purposes of avoiding disclosure.

On whether this Application was a fishing expedition, counsel submitted that the Application was specific and limited to the internet banking policy in place

15 at the time of opening the bank account and at the time that the withdraws complained of occurred.

Counsel for the Applicant concluded that the documents applied for were not confidential and this court should grant the orders sought.

## **Respondent's Submissions**

- 20 Counsel for the Respondent submitted that this Application was a fishing expedition since it did not specify what was required by the Applicant from the internet policy. Learned counsel for the Respondent cited and relied on the case of *Simbamanyo Estates Ltd and another Versus Equity Bank (U) Ltd HCMA No. 583 of 2022.* - 25 Further, counsel for the Respondent argued that the internet policy was immaterial and irrelevant since one cannot find a case for negligence as the Applicant alleges since the issue of negligence is an objective test determined on the standard of what a reasonable man would have done not the subjective obligations of what the Respondent/Defendant ought to have done. Counsel - referred to the definition of negligence in the **8 th** 30 **Edition of the Black's Law**

Page 8 of 16 # 5 **Dictionary** and the case of *Busongora Development Association Limited versus Centenary Rural Development Bank Limited HCCS NO. 0048 OF 2014*.

Additionally, counsel for the Respondent argued that the bank-customer relationship was established by the Terms and Conditions.

10 Regarding the inaccuracies in the statement, counsel submitted that these can be determined at looking at the statement not the internet policy.

On the existence of the alleged internet banking policy, counsel asserts that no such policy existed but was loosely referred to in the investigation report to mean the terms and conditions of E-Banking. Therefore, no such document as

15 an internet banking policy existed. Counsel concluded that in any case, the said documents would be confidential more so when they are not relevant, and are for internal use by the Bank.

### **Submissions in Rejoinder**

- Counsel for the Applicant in rejoinder submitted that cross-examining on the 20 said internet banking policy was not a fishing expedition but rather required by law to rebut the inference that the Respondent's evidence that there was compliance with the said internet policy. The intended cross examination would center on the matters admitted by the Respondent, specified in the Affidavit in Rejoinder at paragraph 5. Further, counsel submitted that the internet policy was - 25 relevant, material and necessary as a reasonable banker would be expected to set up and or include in its internet banking policy reasonable anti-internet banking fraud strategies/measures.

On the existence of the internet banking policy, counsel argued that the Respondent confirmed in the Investigation Report that the internet policy existed 30 and this was also confirmed in the reply to the Applicant's request via an e-mail

Page 9 of 16

dated April 18th 5 , 2023 that the said Policy existed. The Applicant was therefore estopped from denying its existence.

On confidentiality, counsel submitted that no evidence had been adduced to prove that the disclosure would result in the release of state secrets, endangerment of witness and revealing of the identities of informers as held in *Soon Yeon Kong*

10 *and another Versus Attorney General Constitutional Reference No. 06 of 2007.*

### **Determination**

The Civil Procedure Rules as amended under **Order 10 rule 12** state that any party may, without filing any affidavit, apply to court for an order directing any other party to make discovery on oath of the documents which are or have been 15 in his or her possession or power, relating to any matter in question in the suit.

The court has the discretion to allow or refuse the discovery and has to make a finding if the discovery is necessary, is limited to certain documents, disposing the suit or saving costs, order for the production of the documents or make any orders as it deems fit. **See. Order 10 Rule 12 Sub rule 2 of the Civil Procedure**

- 20 **Rules (supra), Order 14 of the Civil Procedure Rules (supra),** and *Dresdner Bank A. G v Sango Bay Estates Ltd (No. 3) [1971] 1 EA 326***.** In the case of **Olouch vs Charagu [2003] 2 E. A at Page 651**, the Court observed that an order for discovery of documents can only be made where the following prerequisites are met: - 25 a) *There is sufficient evidence that the documents exist which the other party has not disclosed;* - *b) The documents relate to the matter in issue in the action; and*

*c) There is sufficient evidence that the documents are in possession, custody or power of the other party.*

Page 10 of 16

5 Where it is established that the above three prerequisites for do exist, the court has discretion whether or not to order disclosure.

The learned judge **Hon. Justice Stephen Mubiru** stated in the case of *Simbamanyo Estates Ltd and another Versus Equity Bank (supra*) that:

*"Discovery covers any non-privileged document that is relevant to the* 10 *issues involved in the trial, including the existence, description, nature, custody, condition, and location of such documents, which appear reasonably calculated to yield admissible evidence. Discovery is the process by which a party may obtain facts and information about its case from the adversary in order to assist its preparation in arguing the* 15 *substance of the claims. It is designed to enable a party to obtain relevant information needed to prepare the party's case."*

In other words, discovery relates to non-privileged documents that are in possession of the Respondent and are relevant to the matter or issue under determination by the Court. The document(s) being contested is an 'Internet

- 20 Banking Policy,' which the Applicant seeks to discover. The said document was stated to be among the documents reviewed by the Respondent in its *Investigation Report into the Alleged Internet Banking Fraud on Account 2291834770 Belonging to Nadya Mileva Dimitrova dated 15th September 2022* and annexed to the Affidavit in Support of this Application as Annexture "B." - 25 Herein, the Investigation Report.

## **The first test is that the document(s) exist(s) and the other party has refused to disclose the same.**

The Internet Banking Policy has been stated to be amongst the documents considered in the Investigation Report of the Respondent. The Report makes

30 reference to terms such as internet banking system 'iBank,' core banking system

Page 11 of 16

- 5 'T24', log ins, PIN among others. These terms can only be deduced from the documents governing the E-Banking transactions or relationship between the Applicant and the Respondent. It is not in dispute that the Applicant had her account enrolled and operated through the E-Banking system of the Respondent. - 10 The Respondent has explained that there is no document specified as the 'Internet Banking Policy' but rather, the word 'policy' was used loosely to refer to the Terms and Conditions of E-Banking. This argument is however frail, in my opinion. The Respondent in its own document, the Investigation Report, refers to having reviewed the 'Internet Banking Policy.' It cannot now seek to - 15 deny its existence.

In any case, the admission that the word 'policy' was used loosely to refer to Terms and Conditions for E-Banking, indicates that a document by whatever name it is called exists and it governs the E-Banking relationship between the Applicant and the Respondent. The wording of that document does not affect its 20 content, in my opinion.

Further, when the Applicant requested for a 'KCB internet banking policy' in place or applicable to her account, a one Judy Wambaire, for the Respondent replied through email wherein she stated that '*the stated Policy is Bank property and restricted for internal use only. To this end, we are unable to provide the*

25 *information as requested.'*

I am therefore of the opinion that an 'Internet Banking Policy' or a document that governs e-banking services exists, and the Respondent does not want to disclosed the same.

Page 12 of 16

## 5 **The second test is that the documents relate to the matter in issue in the action.**

It was the submission of the Applicant that one of the issues for the determination of court was whether the Defendant was negligent in allowing the withdrawals from the Plaintiff's account. In the Applicant's opinion, the internet banking

10 policy is relevant in determination of the duty owed to the Applicant by the Respondent and whether that duty was breached. The Respondent strongly opposed this on the ground that the Application was on a fishing expedition, and that negligence is a tort determined on the standard of a reasonable man.

### According to **Grace Patrick Tumwine Mukubwa in Essays in African**

- 15 **Banking Law and Practice 2nd Edition**, the relationship of banker/customer is a contractual one, with the bank having duties relating to carrying out the customer's payment instructions, dealing with securities deposited with the bank and the way the banker handles information concerning the affairs of the customer. This is what has evolved into the banker-customer relationship; which - 20 places duties and obligations on the bank, breach of which gives rise to an action for damages by the claimant/customer against the bank. These obligations are normally codified under the law or the terms and conditions of the engagement between the bank and the customer. The bank must reasonably exercise its duties and obligations thereunder. - 25 However, in absence of codified duties by the bank to the customer, these duties can be implied*. See. Charles Harry Twagira and another Versus DFCU Bank Ltd HCCS No. 188 of 2018*.

In the current case, the Applicant contends that money was fraudulently withdrawn from her account on the 27th August 2022, 28th August 2022, and 29th

30 August 2022 through the E-service banking service of the Respondent. The

Page 13 of 16

Applicant enrolled the said bank account on the 22nd 5 of March 2021 for the Respondent's E-Banking service.

Whereas a finding can be made on whether the Respondent was negligent or not, in allowing the alleged unauthorized withdrawals from the Applicant's Account, based on the reasonable banking practices, the Internet Banking Policy guides the

10 operation of the E-Banking service in respect to the Applicant's account. It creates the duties and obligations of both the bank and the customer. It is from this policy or terms and conditions that once can determine whether the Respondent's duty to the Applicant was breached or not.

A document is "material" if it is being offered to prove an element of a claim or

- 15 defence that needs to be established for one side or the other to prevail. *See. Simbamanyo Estates Ltd and another versus Equity Bank Ltd (supra).* The Applicant has clearly specified what document she requires from the Respondent and why she requires the same. She seeks to discover the internet banking policy to further prove her case of negligence against the Respondent. - 20 This Application is therefore not a fishing expedition as alleged by the Respondent. I find that the internet banking policy is relevant to the issue in this matter.

## **The third test is that the documents are in the possession, custody or power of the other party.**

25 The Applicant averred that the internet banking policy was in the possession and custody of the Respondent because the Respondent referred to it in its Investigation Report. The existence of the said policy was also admitted by the Respondent in an e-mail communication between one of the Respondent's officers and the Applicant.

Page 14 of 16

- 5 I have looked at the said Investigation Report and the email reply to the Applicant's request for the Policy. The Respondent states that it reviewed the Internet Banking Policy in the Investigation Report, and then admits in the email reply by one of its employees, that the said document is their property and cannot be shared. From the record, there is no contest by the Respondent about - 10 the existence of the Policy. What clearly comes out is that the document is confidential but the Respondent has adduced no evidence in court to support this assertion. **See sections 101, 102 and 103 of the Evidence Act.** The internet banking policy document(s) affects the account of the customer and the customer has the duty to access such information, in absence of the document - 15 being privileged.

Additionally, the Respondent argued that the word 'policy' was loosely used to refer to Terms and Conditions. These terms and conditions either way are supposed to be known by the customer. Further, the Respondent admitted at paragraph (d) of the Affidavit in Opposition of this Application that there was

20 no sole Internet Banking Policy but there exist documents that guide on how

internet banking is to be conducted. I therefore find that the Policy on internet banking or e-banking exists and is in the possession of the Respondent.

5 In the premise, I find this Application has merit and is allowed with costs in the cause.

The Respondent is hereby directed to avail the Applicant and Court a copy of the Policy, documents and the Terms and Conditions that govern the relationship between the Parties in respect of e-banking services within seven (7) days from

10 the date of delivering this ruling.

**Signed and dated at Kampala this 27th day of April 2024.**

# **Harriet Grace MAGALA**

15 **Judge**

Delivered online (ECCMIS) this **30th day of April 2024.**