First National Bank has been fined for breaching POPIA.
The Information Regulator (InfoReg) has issued big-four bank First National Bank (FNB) with an infringement notice and imposed an administrative fine of R1 million.
This, after the InfoReg determined that FNB contravened multiple provisions of the Protection of Personal Information Act (POPIA), following an incident where clients’ data was compromised.
A glitch in FNB’s mobile app inadvertently exposed the personal information of 88 home loan applicants, based on a pre-investigation report by the InfoReg at the time.
ITWeb reported that an FNB customer discovered the glitch, which exposed clients’ data, including personal identifiable information, such as names, identity numbers, contact details and account numbers.
The client reported the matter to the InfoReg. At the time, FNB acknowledged the security hole, adding it was in the process of notifying the relevant authorities, as well as those who have been impacted.
See also
As South Africa’s data privacy enforcer, the InfoReg can issue an enforcement notice, which is about correcting non-compliance, or an infringement notice, which is about imposing an administrative fine for an alleged offence, against an organisation for POPIAcontravention.
Yesterday, the information watchdog issued notices against FNB following a POPIA compliance assessment and subsequently imposed an administrative fine.
In the enforcement notice, the InfoReg states the personal information of 88 data subjects, including nine data subjects’ account numbers, was exposed to 696 unauthorised individuals.
It also cautions about the likelihood of substantial damage to the nine data subjects whose account numbers were accessed, saying the existence of other security compromises where personal information had been unlawfully acquired and/or accessed, unrelated to the FNB security compromise, increases the overall risk exposure and potential cumulative impact.
Merged or aggregated with other data, the personal information may be used to form complete profiles of data subjects.
In its assessment, the regulator says it identified shortcomings in FNB’s identification, classification and response to repeated security incidents that constituted interference with the confidentiality of personal information.
The findings raised concerns regarding the adequacy of the bank’s technical and organisational measures to protect personal information against unlawful access and other forms of unauthorised processing, it states.
Furthermore, the assessment identified deficiencies in FNB’s implementation of the security safeguards required under section 19 of POPIA, as well as weaknesses in its governance frameworks relating to the retention of personal information.
“Of regulatory significance, the regulator found that FNB committed an offence in terms of section 105 of POPIA. The finding relates to FNB’s unlawful processing of data subjects’ account information through its failure to comply with the security safeguards prescribed by section 19 of POPIA.
“The regulator found that FNB reasonably ought to have known that there was a risk of such a contravention occurring and that the contravention was likely to cause substantial damage or distress to affected individuals, but it failed to take reasonable steps to prevent it.
“Consequently, the regulator has issued an infringement notice against FNB and imposed an administrative fine of R1 000 000.”
The regulator has called on public and private bodies to review their compliance programmes, strengthen information-security safeguards, ensure that information officers discharge their statutory responsibilities and respond promptly to regulatory directives.
“These enforcement notices and infringement notices underscore the seriousness with which failures to protect personal information are treated under POPIA, particularly where shortcomings in security safeguards and organisational governance expose data subjects to potential harm.”
Advocate Pansy Tlakula, chairperson of the Information Regulator. (Photograph by Strike A Pose Studio)
FNB joins organisations like TransUnion, Dis-Chem, the South African Police Service, the Department of Basic Education and the Department of Justice and Constitutional Development (DJCD) to have been fined by the regulator.
The DJCD and education department have both been fined R5 million for not complying with POPIA.
POPIA sets down firm frameworks that companies must abide by to avoid fines, criminal prosecution and potential reputation loss.
Breaching the rules and regulations outlined by the Act can have serious, long-lasting financial and reputational implications for the business.
POPIA makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach.
The regulator can give a public body a grace period to remedy a POPIA violation before taking further enforcement action.
During a media briefing in September, the InfoReg signalled that the grace period given to public bodies to remedy violations is a key weakness in POPIA.
InfoReg chairperson advocate Pansy Tlakula said while several high-value fines have been issued to POPIA violators, the fines have not materialised; instead, public bodies in the wrong have challenged them in court.
The data privacy law gives the institution a specified period to comply. If the institution fails to do so, it can challenge the regulator’s enforcement action in court.
“What tends to happen is that public bodies comply within the timeframes, and once they comply, we cannot move forward with the fine. For those who go to court, we wait for legal processes to unfold,” said Tlakula.
For the full scope of FNB’s enforcement notice, click here.