The Information Regulator has issued First National Bank (FNB) with a R1 million infringement notice for breaching the Protection of Personal Information Act (POPIA), according to the notice as reported on 26 October.

The notice covers a February 2022 system error that exposed personal information of home-loan applicants, as well as how the bank collected and kept other data. FNB has 30 days to pay, according to the reports.

What the regulator found

The Regulator found breaches of sections 5, 8, 12, 14, 15, 19 and 105 of POPIA, according to the notice, which was signed by Regulator chairperson Pansy Tlakula.

  • Collecting data from newspapers: FNB built a database of people involved in money laundering and politically exposed persons using newspaper articles. The Regulator said newspapers are not a "public record" under section 12(2)(a) and that no consent was given.
  • Keeping data indefinitely: FNB's retention schedule allowed records such as cancelled or spoiled employee tax certificates, asset ownership records and securities registers to be kept indefinitely, with no stated legal justification under section 14(1).

The 2022 exposure

FNB confirmed the security compromise on 21 February 2022, according to the notice. Some individual account holders were classified as employees, which gave them access to home-loan applicants' information.

The exposed data included full names, ID numbers, contact details, physical addresses, income, salary information and account numbers. The banking app listed names and ID numbers, and clicking an entry showed all personal information linked to that application.

App users alerted FNB in March and again in May, and FNB acknowledged the second complaint on 27 September, according to the notice. The reports do not state the year of the complaints.

What happens next

FNB has 30 days to pay the fine. One report says the bank may instead elect to be tried in court. At the time of writing we had not found a statement from FNB on the notice.

What we do not yet know

  • How many people were affected. The notice reportedly says personal information of 88 people was exposed to 696 unauthorised individuals, but another passage suggests contact and account details of nine of the 88 were accessed by 696 people. The figures conflict.
  • Whether FNB will pay or contest the notice, and what it says about the findings.