The regulator imposed a fine of one million rand on First National Bank (FNB) after discovering that a incorrectly configured function in the FNB application allowed 696 customers to view mortgage applications belonging to 88 other individuals. Furthermore, the bank failed to rectify this error despite two reports from customers.
The fine relates to a violation of Section 105 of the Protection of Personal Information Act (POPIA), which governs the improper handling of bank account numbers. In this case, the account numbers of nine of the 88 affected individuals were disclosed. The regulator announced the fine on October 27; on the same day, a fine of R500,000 was announced for the Central Johannesburg TVET College.
Details of Access Violation
According to the enforcement notice, signed by the regulator's chairperson Pansi Tlakululi and dated October 21, some account holders were mistakenly classified as FNB employees. This granted them access within the banking application to a list of names and identification numbers of individuals with incomplete mortgage applications. Clicking on a name opened the full application, containing contact details, physical address, income and salary information, and in some cases, account numbers.
The customer first notified FNB about the possibility of viewing other customers' applications on March 30, 2022. A second customer reported the same issue on May 3, 2022. In both instances, the regulator found that FNB had revoked the individual's access but treated the report as an isolated incident rather than a personal data compromise, and did not notify the regulator. The regulator only intervened after receiving a complaint in September 2022.
In the notice, the regulator stated: "FNB failed to remedy this personal information privacy vulnerability even after two warnings from two parties who knew they should not have accessed such personal data." It characterized FNB's handling of these incidents as "negligent" and questioned how long the information would have remained exposed if the regulator had not intervened.
Consequences of Data Leak
The regulator noted that the disclosed information exposes affected customers to risks of identity theft, SIM card fraud, and attempts to bypass 'know your customer' bank checks. The risk was compounded by the fact that data from credit bureaus from previous leaks in Experian and TransUnion were already circulating online, which criminals could combine with FNB data to create more complete victim profiles.
The notice extends beyond the application leak. The regulator also found that FNB could not legally justify collecting personal information from newspapers based on the section of POPIA it relied upon. The bank collects such information primarily for vetting politically exposed persons—individuals holding prominent public offices whom banks are required to vet more thoroughly under anti-money laundering rules. The regulator ruled that a newspaper is not a 'public register' as defined by the law. FNB must now document whether any other lawful basis permits the collection of such data and cease collection if no such basis exists.
FNB's record retention schedule also allowed for the indefinite storage of certain personal data, including cancelled employee tax certificates and securities registers, without specifying a legal basis. The bank is obliged to appoint a records management company to destroy such documents and provide the regulator with a certificate of destruction.
Additionally, the regulator ordered FNB to amend its privacy notice because it relies on bases such as 'legitimate interest' for sharing customer information, which are not valid exceptions for further processing under POPIA, and fails to list all customer rights under the law. FNB must provide the regulator with proof of compliance within 90 days and has 30 days to appeal the enforcement notice.
Hangi Mbedzi, the regulator's acting senior manager for POPIA, told SABC News that the fines reflect the seriousness of the violations and the risks they pose to affected individuals. TechCentral contacted FNB for comment, including information on the bank's intention to appeal the enforcement notice.
