FNB fined one million rand over exposed customer data
By the AFREEQUE newsroom, based on Bizcommunity
South African bank First National Bank has been fined one million rand for repeated shortcomings in protecting customer data on its digital home loan platform. The regulator identified weaknesses in detecting incidents and preventing unauthorised access, according to its investigation.
South African bank First National Bank (FNB) has been fined one million rand by the Information Regulator after security shortcomings were found on its digital home loan application platform. The regulator announced the sanction on 26 October, following an assessment conducted under South Africa’s Protection of Personal Information Act (PoPIA), Bizcommunity reports.
The assessment followed a notification from FNB about a security breach, after press reports on the exposure of customer data and illegal access to the platform. The exposed information included account numbers. The regulator identified repeated incidents as well as weaknesses in their detection, classification and handling, and in the technical and organisational measures intended to prevent unauthorised access.
The regulator concluded that FNB had breached the security obligations set out in section 19 of PoPIA and committed an offence under section 105. It believes the bank should have anticipated the risk of a breach capable of causing significant harm or distress to its customers, and that it failed to take reasonable measures to prevent it. It called on public and private bodies to strengthen their security systems and compliance programmes.
The sanction comes after FNB launched new unsecured business loans, announced on 23 October. The offer concerns a different area of the bank’s activities from the home loan application platform covered by the assessment.
