FNB Fined R1 Million for Failing to Protect Customer Data
First National Bank (FNB) has been fined R1 million by the Information Regulator for failing to comply with several parts of the Protection of Personal Information (POPI) Act. The regulator found that the bank inappropriately collected personal information, failed to adequately protect it, and kept some of it for longer than necessary.
The fine
The Information Regulator determined that FNB contravened section 8 of POPIA, in so far as it relates to the processing of a data subject’s account number, in accordance with section 105(1) of the Act. FNB now has 30 days to pay the R1 million fine or elect to be tried in court for the alleged offence.
The 2022 security compromise
The regulator outlined several breaches, starting with a system error in 2022. On 21 February 2022, FNB confirmed a security compromise in which the personal information of 88 data subjects was exposed to 696 unauthorised individuals.
The cause was that some individual account holders had been classified as employees by the bank. That gave them access to the personal information of home loan applicants, including full names, identity numbers and contact details. The information could be reached through FNB’s banking app: clicking a list item showing a name and ID number exposed all the personal information linked to the application.
Collecting information from newspapers
The regulator also took issue with how FNB collected some personal information. The bank gathered data from “public sources” such as newspapers, company registers and online searches, mainly about customers connected to politics, known as Prominent Influential Persons (PIPs). The regulator noted this was mostly in line with FNB’s anti-money laundering policies for enhanced due diligence on Politically Exposed Persons.
The problem is a legal distinction. Section 12(2)(a) of POPIA refers to a public record, not a public source. The regulator’s firm view was that information from newspapers is not a public record, nor has it been deliberately made public by the person concerned. Except in specific circumstances, POPIA requires personal information to be collected directly from the data subject.
Keeping data too long
The third contravention concerned retention. FNB kept certain details indefinitely, with no specific justification. The regulator said the legal basis for the retention isn’t stated in FNB’s Retention Schedule, and FNB could not explain it. Keeping records longer than required contravenes section 14(1) of POPIA.
Summary of the findings
| Issue |
What the regulator found |
| Security safeguards |
2022 error exposed 88 people’s data to 696 unauthorised individuals |
| Collection |
Personal information gathered from newspapers, which are not a “public record” |
| Retention |
Some data held indefinitely without a stated legal basis |
What it means for businesses
The ruling is a reminder that compliance has to cover more than security. Other organisations, especially those that do due diligence checks, may want to review:
- Who has access to what. Make sure account types and staff classifications can’t give customers access to other people’s data.
- Where information is collected from. Check that sources qualify under POPIA, and that collecting from third parties is justified.
- How long data is kept. Make sure the retention schedule states a legal basis for each category.
- Whether anti-money laundering duties align with POPIA. One obligation doesn’t override the other.
If you’re unsure where your organisation stands, a legal or compliance specialist can help.
What it means for customers
POPIA gives you rights over how your information is collected, used and kept. If you believe an organisation has mishandled your data, you can complain to the Information Regulator.
The bottom line
A R1 million fine is small for a bank of FNB’s size, but the findings matter more than the amount. They show the regulator is looking closely at access controls, collection methods and data retention, and that even large institutions can fall short on all three.
Source: Information Regulator statement on FNB, as reported in the original article.
Do you need a Quote for our Tax and Accounting Services?
Contact our team via any of the following channels to get a proposal for your accounting and tax services:
Subscribe to our newsletters.
Purchase Contract TEMPLATES and BUSINESS STATIONERY at www.ZEELIEONLINE.com
Disclaimer:
The views or opinions expressed on this site are solely those of the original authors and other contributors.
The material and information contained on this website is for general information purposes only.
This information is for general purposes only. Don't use this information for making business, legal and tax decisions without consulting a professional.
We do not make any express or implied representation, as to the completeness or accuracy of the information published.
Tax law regularly changes, so any tax information on this site could become outdated.
We are not responsible for any other websites that you may access through links on our website.
ZPA accepts no liability for any loss or damage arising from the use of any material on this site.
