FNB: R1 Million POPIA Fine Issued by InfoReg for Data Breach

• First National Bank (FNB) has been fined R1 million by the Information Regulator (InfoReg) for breaching the Protection of Personal Information Act (POPIA).
• The fine stems from a mobile app glitch that exposed the personal information of 88 home loan applicants, including account numbers for nine individuals, to 696 unauthorised persons.
• The InfoReg identified shortcomings in FNB's incident response, technical safeguards, governance frameworks, and specifically, deficiencies in implementing Section 19 POPIA security safeguards.
• FNB was found to have committed an offence under Section 105 of POPIA, having failed to prevent a known risk of substantial damage or distress to affected individuals.
• This enforcement action signals the InfoReg's serious approach to inadequate data security and governance, urging all entities to strengthen their POPIA compliance.

The R1 million administrative fine imposed on FNB, delivered via an infringement notice, serves as a clear signal from the South African Information Regulator regarding its commitment to enforcing POPIA.

First National Bank (FNB), one of South Africa's prominent financial institutions, has been subjected to an administrative fine of R1 million by the Information Regulator (InfoReg) for contravening the Protection of Personal Information Act (POPIA). This significant penalty follows an incident where sensitive client data was compromised due to a flaw within the bank's mobile application. The InfoReg's pre-investigation report initially indicated that this glitch inadvertently exposed the personal information of 88 individuals who had applied for home loans.

The security vulnerability came to light when an FNB customer discovered the mobile app's defect, which allowed access to personal identifiable information. This exposed data included critical details such as names, identity numbers, contact information, and account numbers. The vigilant customer promptly reported the issue to the InfoReg, triggering the regulatory body's involvement. At the time of the discovery, FNB acknowledged the existence of the security flaw and stated its intention to notify both the relevant authorities and the affected individuals.

Following a comprehensive POPIA compliance assessment, the Information Regulator issued an infringement notice against FNB, detailing the extent of the data exposure and the bank's regulatory failures. The assessment revealed that the personal information of 88 data subjects, including the account numbers of nine specific individuals, was accessible to 696 unauthorised persons. The InfoReg highlighted the potential for substantial harm to these nine data subjects whose account numbers were compromised, noting that the risk was amplified by the existence of other unrelated security breaches where personal information had been unlawfully acquired. This aggregation of data could facilitate the creation of complete profiles of data subjects, increasing their overall risk exposure and potential cumulative impact.

The InfoReg's investigation identified critical shortcomings in FNB's data security safeguards and incident response protocols. Specifically, the regulator found deficiencies in how FNB identified, classified, and responded to repeated security incidents that compromised the confidentiality of personal information. Concerns were raised regarding the adequacy of the bank's technical and organisational measures designed to protect personal information from unlawful access and other forms of unauthorised processing. Furthermore, the assessment pinpointed weaknesses in FNB’s implementation of the security safeguards mandated by Section 19 of POPIA, alongside deficiencies in its governance frameworks pertaining to the retention of personal information. The InfoReg concluded that FNB had committed an offence under Section 105 of POPIA by unlawfully processing data subjects' account information through its failure to adhere to the prescribed Section 19 security safeguards. The regulator determined that FNB reasonably should have anticipated the risk of such a contravention and the likelihood of substantial damage or distress to affected individuals, yet failed to implement reasonable preventative measures.

The R1 million administrative fine imposed on FNB, delivered via an infringement notice, serves as a clear signal from the South African Information Regulator regarding its commitment to enforcing POPIA. This action underscores the gravity with which failures to protect personal information are viewed, particularly when they involve inadequate data security safeguards and organisational governance that expose data subjects to potential harm. The InfoReg's decision to levy a substantial penalty against a major financial institution highlights the critical importance of robust POPIA compliance programs.

In light of this enforcement action, the Information Regulator has urged both public and private sector entities to meticulously review their existing compliance frameworks. It has specifically called for the strengthening of information security safeguards, ensuring that designated information officers diligently fulfil their statutory responsibilities, and establishing mechanisms for prompt responses to regulatory directives. This FNB R1 million POPIA fine exemplifies the InfoReg's increased enforcement posture, particularly concerning Section 19 violations and the broader need for effective incident response and governance.

This R1 million fine against FNB signals the Information Regulator's increased enforcement of POPIA, particularly regarding inadequate security safeguards (Section 19) and incident response. Lawyers and compliance officers should immediately advise clients to review and strengthen their POPIA compliance programs, data security measures, and governance frameworks to avoid similar penalties, especially concerning the identification, classification, and response to security incidents.

Source: Reporting based on the Information Regulator's findings