Bank fined R1m for not protecting customer data
FNB has been handed a R1m fine by the Information Regulator for failing to protect clients’ personal data. The fine is due to the banking giant’s failure to comply with several parts of the Protection of Personal Information (Popi) Act.
BusinessTech reports that the regulator determined that FNB had ‘contravened the provisions of section 8 in so far as the provisions relate to the processing of an account number of a data subject in accordance with section 105(1) of the Popi Act’.
FNB will now have 30 days to pay the fine or elect to be tried in court and be charged for the alleged offence.
In a statement, the regulator outlined several breaches of the Act by FNB, including the exposure of sensitive information due to a 2022 system error: ‘On 21 February 2022, FNB confirmed a security compromise, in which the personal information of 88 data subjects was exposed to 696 unauthorised individuals.’
This was due to some account holders being classed as employees by the bank, giving them access to other clients’ sensitive information.
‘The unlawful access was as a result of some individual account holders being classified as employees,’ the regulator said.
The regulator took issue with FNB collecting information from ‘public sources’ such as newspapers, company registers, and online searches.
This data collection was primarily related to customers connected to politics, referred to as Prominent Influential Persons.
Article disclaimer: While we have made every effort to ensure the accuracy of this article, it is not intended to provide final legal advice as facts and situations will differ from case to case, and therefore specific legal advice should be sought with a lawyer.
