FNB fined R1 million after banking app exposed sensitive customer data

The regulator found that the bank did not deliberately disclose its customers’ information. However, it concluded that FNB failed to respond adequately to a security vulnerability after the problem became known.

The incident exposed information linked to 88 home loan applicants. In total, 696 unauthorised people accessed the applications, which contained identity numbers and, in nine cases, bank account numbers.

How the banking app flaw exposed customer information

The vulnerability involved a feature designed for bank employees assisting customers with home loan applications. A flaw in the banking app allowed some customers to access that feature, giving them access to information that was not intended for them.

That type of access creates a serious privacy risk because personal information can be viewed outside the purpose for which it was collected. Home loan applications can contain information that helps identify an individual and may include financial details, making effective access controls particularly important.

In this case, the Information Regulator’s concerns extended beyond the existence of the technical flaw. The regulator focused heavily on what happened after FNB was alerted to the unauthorised access.

Regulator criticised FNB’s response

FNB restricted access for the individuals involved after the bank was alerted to the problem. However, the regulator found that the bank did not take sufficient steps to fix the broader security vulnerability.

Instead, the reports were treated as separate incidents. The regulator’s assessment found shortcomings in how FNB identified, classified and responded to repeated security incidents.

“The assessment identified significant shortcomings in FNB’s identification, classification and response to repeated security incidents that constituted interference with the confidentiality of personal information,” the Information Regulator said.

The regulator said those findings raised concerns about whether the bank had adequate technical and organisational measures in place to protect personal information against unlawful access and other forms of unauthorised processing.

This distinction is important in data-protection cases. Limiting access after an incident may reduce immediate exposure, but it does not necessarily address the underlying vulnerability. A broader response may require organisations to establish how the access occurred, determine whether the same weakness affects other users and make changes that prevent the problem from recurring.

Why the POPIA fine was imposed

The Information Regulator found that FNB had committed an offence under section 105 of the Protection of Personal Information Act, commonly known as POPIA.

The finding was based on the regulator’s view that FNB should have known there was a risk of a contravention and that the breach was likely to cause substantial damage or distress to the affected individuals.

POPIA places responsibilities on organisations that collect and process personal information. Those responsibilities include taking reasonable security measures and ensuring that personal information is not accessed or processed without authorisation.

The R1 million penalty therefore relates not only to the data that was exposed, but also to the organisation’s handling of the security weakness and the repeated reports connected to it.

Other contraventions identified

The enforcement notice also identified additional POPIA contraventions. These included the unlawful collection of personal information from newspaper reports and the indefinite retention of certain records without an adequately stated legal basis.

These findings point to two separate areas of data governance: how information is collected and how long it is kept. Organisations generally need a lawful reason for collecting personal information and should be able to explain why records remain in their systems.

Keeping records indefinitely without a clearly stated legal basis can create additional privacy and security risks. The longer information is retained, the longer it may remain exposed to potential unauthorised access or other forms of misuse.

Information Regulator calls for stronger safeguards

The Information Regulator called on public and private bodies to review their compliance programmes and strengthen their information-security safeguards.

It also urged organisations to ensure that their Information Officers fulfil their statutory responsibilities and that regulatory directives are handled promptly.

Information Officers play an important role in helping organisations manage compliance, privacy risks and responses to data-protection concerns. Effective governance requires more than policies on paper: organisations must also identify weaknesses, investigate incidents and act on recurring warning signs.

“These Enforcement Notices and Infringement Notices underscore the seriousness with which failures to protect personal information are treated under POPIA, particularly where shortcomings in security safeguards and organisational governance expose data subjects to potential harm,” the regulator said.

What the case means for customers

The case highlights the risks that can arise when a digital service gives users access to information outside the function intended for them. It also shows why repeated reports of unauthorised access need to be assessed as part of a wider security problem, rather than handled only as isolated events.

For customers, the exposure of identity numbers and bank account numbers can create concerns about privacy and potential misuse. For companies, the enforcement action is a reminder that data protection covers both technical security and the organisational processes used to detect and respond to incidents.

The regulator’s message is that organisations handling personal information must maintain effective safeguards, respond decisively when weaknesses are identified and ensure that their collection and retention practices have a lawful foundation.