First National Bank (FNB) says it has remedied its Protection of Personal Information Act (POPIA) compliance shortcomings that resulted in a R1 million administrative fine.
The Information Regulator (InfoReg) this week fined the big-four bank R1 million after it determined that FNB contravened multiple provisions of POPIA, following an incident where clients’ data was compromised.
A glitch in FNB’s mobile app inadvertently exposed the personal information of 88 home loan applicants, based on a pre-investigation report by the InfoReg at the time.
ITWeb reported that an FNB customer discovered the glitch, which exposed clients’ data, including personal identifiable information, such as names, identity numbers, contact details and account numbers.
The information watchdog issued an enforcement notice and infringement notice against FNB and subsequently imposed an administrative fine.
In the enforcement notice, the regulator cautioned about the likelihood of substantial damage to data subjects whose account numbers were accessed, saying the existence of other security compromises where personal information had been unlawfully acquired and/or accessed increases the overall risk exposure.
In a statement via e-mail, FNB confirms it has been issued with findings, final recommendations and a nominal fine, following an assessment conducted by the InfoReg in October 2023.
“The protection of customer information remains a core priority for the bank. Since identifying the issue, comprehensive remediation has been completed, with no customers experiencing financial harm as a result.”
The bank says it has spent the past three years strengthening its systems, governance, resources and employee training to improve the protection of customer information and enhance its overall control environment.
“While this matter has been fully remediated, FNB remains committed to continuously strengthening its data protection capabilities to meet evolving customer safety expectations, regulatory requirements and the changing security landscape.”
The fine sees FNB join organisations like TransUnion, Dis-Chem, the South African Police Service, the Department of Basic Education and the Department of Justice and Constitutional Development (DJCD) to have been fined by the regulator.
The DJCD and education department have both been fined R5 million for not complying with POPIA.
POPIA sets down firm frameworks that companies must abide by to avoid fines, criminal prosecution and potential reputation loss.
Breaching the rules and regulations outlined by the Act can have serious, long-lasting financial and reputational implications for the business.
It makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach.
The regulator can give a public body a grace period to remedy a POPIA violation before taking further enforcement action.
Share
