South Africa's Information Regulator fines FNB R1 million

The South African Information Regulator has fined First National Bank (FNB) R1 million for violating the Protection of Personal Information Act (POPIA). The penalty follows an assessment of security breaches on the bank’s digital home loan application platform, which resulted in the exposure of customer account numbers.

The regulator identified significant weaknesses in FNB’s ability to identify, classify, and respond to repeated security incidents. The assessment also highlighted deficiencies in the technical and organizational measures used to protect personal information, as well as failures in governance frameworks regarding the retention of data.

In addition to the fine against FNB, the Information Regulator issued a R500,000 fine to Central Johannesburg TVET College for failing to comply with an enforcement notice regarding the unlawful processing of personal information.