South Africa’s Information Regulator Issues First National Bank with an Enforcement Notice and a R1 million fine

What happened?

South Africa’s Information Regulator SA (“the IR”) has issued an Enforcement Notice (“the Notice”) against South African bank, FNB South Africa, part of FirstRand.  The Notice stems from a series of incidents in 2022, where individual bank account holders were able to access home loan applicants’ personal information. The unauthorised individuals were able to access personal information like income and salary information.

What did the Information Regulator Find?

The IR conducted an own-initiative assessment and found many contraventions. These included that: FNB’s Privacy Policy was not POPIA compliant; its collection of personal information from newspapers did not comply with POPIA; the indefinite retention of certain personal information records was unlawful; and that it failed to secure the confidentiality of personal information in its possession or under its control.

What Penalty Did the Information Regulator Impose?

This Enforcement Notice is particularly significant for financial services and other institutions that allocate customers and clients account numbers. POPIA’s section 105 addresses the use of account numbers and provides heightened obligations when account numbers are used. It found that FNB is liable to a fine of R1,000,000.00 for exposing the account numbers.

What Can Financial Services Providers Do?

Financial services institutions in particular, and other institutions that may allocate their clients and customers account numbers, would do well to review their personal information governance frameworks, in light of the order that FNB amend its governance frameworks to address the identified shortcomings.