FNB fined R1 million for exposing private customer data

The Information Regulator of South Africa has imposed a R1 million fine on First National Bank (FNB) for failing to protect customers’ personal data.

FNB now has 30 days to pay the fine. The regulator found that the bank infringed on several key sections and conditions of the Protection of Personal Information Act (POPIA).

It ruled that FNB inappropriately collected information from South Africans, which it then failed to protect adequately.

In a statement, the regulator outlined breaches in sections 5, 8, 12, 14, 15, 19 and 105 of POPIA. In one instance, a system blunder from FNB exposed sensitive personal information of account holders.

“On 21 February 2022, FNB confirmed a security compromise, in which the personal information of 88 data subjects was exposed to 696 unauthorised individuals,” the regulator said.

It explained that the bank later confirmed details of this compromise. It wasn’t an outside data breach, but a system error.

“The unlawful access was as a result of some individual account holders being classified as employees. This resulted in them having access to the personal information of home loan applicants,” it said.

Information exposed in this blunder included full names, identity numbers, contact details, physical addresses, income, salary information, and account numbers.

This granted unauthorised individuals access to the information of 88 data subjects in the FNB banking app. The app listed the names and ID numbers of the affected individuals.

“When the list item with the name and ID number was clicked, all the personal information linked to the application would be exposed.”

The Information Regulator said two instances of this exposure of personal information had been brought to FNB’s attention on separate occasions.

On two occasions, once in March and then in May, FNB app users told the bank that they could access the personal information of home loan applicants.

FNB acknowledged the second complaint on 27 September, seven months after the February exposure took place and five months after the May complaints.

FNB fined for numerous POPIA violations

Pansy Tlakula, chairperson of the Information Regulator, signed the enforcement notice against FNB.
“FNB did not address this vulnerability to the confidentiality of personal information even after two alerts by two parties,” the regulator said.

“The risk that could adversely impact data subjects is that any information that is exposed could be enriched using personal information from other breaches and enable opportunities for identity theft.”

In a related breach of Section 105 of POPIA, the regulator said that the contact details and account numbers of nine of the 88 affected data subjects were accessed by 696 individuals.

“Each unauthorised access represented a potential exposure of the affected data subjects’ personal information to risks, including potential misuse, disclosure, or further compromise,” it said.

The exposure through the system error was only one of the several POPIA infringement notices FNB received from the Information Regulator.

In another instance, the regulator said that FNB collected customer data from newspapers to build its database on people involved in money laundering and people who were politically exposed.

The regulator said newspapers do not qualify as a “public record” under POPIA section 12 (2) (a), nor is it a disclosure made with the consent of the party, making this activity by FNB unlawful.

In another POPIA breach, the regulator criticised FNB’s data retention schedule. This schedule permitted the indefinite retention of customers’ personal records.

This included FNB retaining information from customers, such as cancelled or spoiled employee tax certificates, asset ownership records, and securities registers.

The bank did this without any stated legal justification, which breached Section 14 (1) of POPIA, the Information Regulator said