FNB fined R1m over exposure of customer data

First National Bank has been issued with a R1 million administrative fine after South Africa’s Information Regulator found that the bank failed to adequately protect customers’ personal information.

The penalty follows an investigation into a security compromise involving FNB’s digital home-loan application platform, through which unauthorised users were able to access the personal details of applicants.

The regulator announced the fine on 26 October, citing contraventions of the Protection of Personal Information Act (POPIA).

According to the regulator, a technical error meant that some customers were incorrectly classified as employees, giving them access to information that should have been restricted. The personal information of 88 home-loan applicants was exposed to 696 unauthorised users.

The information potentially accessible included names, identity numbers, contact details, physical addresses, income and salary information, and account numbers. The regulator said FNB had failed to address the vulnerability adequately despite being alerted to the exposure on two occasions. It warned that information obtained in this way could be combined with data from other breaches, creating opportunities for identity theft.

The R1 million penalty relates specifically to the regulator’s finding concerning the processing of a data subject’s account number. FNB may pay the fine, arrange to pay it in instalments or elect to be tried in court on the alleged offence within 30 days of receiving the infringement notice.

The regulator also raised concerns about FNB’s collection of personal information from newspapers as part of its due-diligence processes, and about its retention of certain records for longer than necessary.

It said newspapers were public sources but did not automatically qualify as public records under the relevant provision of POPIA. Personal information must generally be collected directly from the person concerned, unless an exception applies.

In an earlier response to ITWeb, FNB said it had notified affected home-loan applicants, introduced fraud monitoring on their accounts and corrected the technical issue. The response preceded the latest fine.

It could not be confirmed whether FNB had paid the penalty or intended to challenge it.

Sources: BusinessTech, 26 October; MyBroadband, 26 October; ENS, 26 October; ITWeb, earlier report on the security compromise.