The Information Regulator has fined First National Bank (FNB) R1 million. It found that a wrong setting in the FNB app let 696 customers see the home loan applications of 88 other people.
The regulator also found that the bank did not fix the problem after customers reported it twice. The fine was announced on 27 October, SABC News reported.
“FNB did not address this vulnerability to the confidentiality of personal information even after two alerts by two parties who were mindful of the fact that they should not have been able to have access to such personal information,” the regulator said in its enforcement notice.
The fine is for an offence under section 105 of the Protection of Personal Information Act (Popia). This section deals with the mishandling of bank account numbers. Nine of the 88 people had their account numbers exposed.
The notice was signed by regulator chair Pansy Tlakula and dated 21 October. It said some account holders had been wrongly listed as FNB employees in the system.
This gave them access in the banking app to a list of names and ID numbers of people with home loan applications in progress. Clicking on a name opened the full application.
The applications showed contact details, physical addresses, income and salary information. In some cases, they also showed account numbers.
A customer told FNB on 30 March 2022 that they could see other customers’ loan applications. A second customer reported the same problem on 3 May 2022.
Each time, the regulator found, FNB removed that person’s access but treated the report as a once-off. The bank did not treat it as a leak of personal information and did not report it to the regulator.
The regulator only became involved after a complaint was lodged with it in September 2022. It called FNB’s handling of the matter “lackadaisical”. It also asked how much longer the information would have stayed exposed if it had not stepped in.
The regulator said the leaked details put customers at risk of identity theft, Sim-swap fraud and attempts to get past bank identity checks. It said criminals could combine the FNB data with credit bureau data from earlier Experian and TransUnion breaches that is already online.
The notice also covered other issues. The regulator said FNB could not lawfully justify collecting personal information from newspapers under the section of Popia it relied on.
The bank mainly collects this information to screen politically exposed persons. These are people in senior public positions whom banks must check more closely under anti-money-laundering rules. The regulator said a newspaper is not a “public record” as defined in the act.
FNB must now record whether another legal ground allows the collection, and stop if none does.
The regulator also found that FNB’s records schedule let some personal information be kept forever without a clear legal reason. This included cancelled employee tax certificates and registers of securities.
The bank must hire a records management company to destroy these records. It must then give the regulator a certificate of destruction.
FNB was also ordered to change its privacy notice. The regulator said the notice relies on grounds such as “legitimate interest” to share customer information, which are not valid under Popia. It also said the notice does not list all of customers’ rights under the act.
Hangi Mbedzi, the regulator’s acting senior manager for Popia, told SABC News the fines showed how serious the breaches were and the risk they posed to the people affected.
The regulator also fined Central Johannesburg TVET College R500 000 on the same day.
FNB has 30 days to appeal against the enforcement notice. It must report back to the regulator with proof that it has complied within 90 days.
Source: this article is based on reporting by TechCentral. Image: TechCentral. Written with the help of AI and published by the Tzaneen Voice Technology desk. See our Editorial Standards.
Werner Jacobs covers technology for Tzaneen Voice. Werner reports on mobile networks, data prices, internet access, smartphones, apps, AI, cybersecurity and South African tech companies. Each story explains what a new product, price change or policy means for ordinary users in South Africa.