Top bank in South Africa fined R1 million for not protecting customer data
First National Bank (FNB) has been hit with an R1 million fine by the Information Regulator for failing to protect clients’ personal data.
The fine is due to the banking giant’s failure to comply with several parts of the Protection of Personal Information (POPI) Act.
The Information Regulator determined that FNB had “contravened the provisions of section 8 in so far as the provisions relate to the processing of an account number of a data subject in accordance with section 105(1) of the Protection of Personal Information Act.”
FNB will now have 30 days to pay the R1 million fine or elect to be tried in court and be charged for the alleged offence.
The regulator ruled that FNB inappropriately collected personal information and failed to adequately protect it.
In a statement, the regulator outlined several breaches of the POPI Act by FNB, including the exposure of sensitive information due to a 2022 system error.
“On 21 February 2022, FNB confirmed a security compromise, in which the personal information of 88 data subjects was exposed to 696 unauthorised individuals,” the regulator said.
This was due to some account holders being classed as employees by the bank, giving them access to other clients’ sensitive information.
“The unlawful access was as a result of some individual account holders being classified as employees,” the regulator said.
“This resulted in them having access to the personal information of home loan applicants.”
This specific instance involved the exposure of customers’ full names, identity numbers, and contact details.
This personal information could then be accessed by some unauthorised users through FNB’s banking app.
“When the list item with the name and ID number was clicked, all the personal information linked to the application would be exposed,” the regulator said.
Collecting information from newspapers
Another infringement noted by the Information Regulator was that FNB had not followed the correct procedure for collecting personal information in some cases.
The regulator took issue with FNB collecting information from “public sources” such as newspapers, company registers, and online searches.
This data collection was primarily related to customers connected to politics, referred to as Prominent Influential Persons (PIPs).
The regulator said data collection from these sources “is mostly in line with its Anti-Money Laundering (AML) Policies for purposes of enhanced due diligence on Politically Exposed Persons (PEPs) known as Prominent Influential Persons (PIPs).”
The collection of information from newspapers was flagged by the regulator due to the difference between a “public source” and a “public record”.
“Regarding the collection of personal information from newspapers, it is important to note that section 12(2)(a) of POPIA refers to a public record as opposed to a public source,” the regulator said.
“The Regulator is of the firm view that this collection of personal information from newspapers does not fall under public record, nor has the information contained in such newspapers deliberately been made public by the data subject.”
Except in specific circumstances, personal information must be collected directly from a data subject under the POPI Act.
Another POPI Act contravention flagged by the Information Regulator was FNB’s retention of specific data for longer than necessary.
Certain details were retained indefinitely by FNB, for which the regulator said there was no specific justification.
“The legal basis for such retention is not stated in the Retention Schedule and an explanation for same could not be provided by FNB,” it said.
“As such, the retention of records of personal information for a period longer than required is in contravention of the provision of section 14(1) of POPIA.”
Loading ...