South Africa’s Information Regulator has fined one of the country’s biggest banks R1 million. The first national bank popi fine follows findings that FNB did not properly protect customer data. The regulator also found problems with how the bank collected and kept some personal details. For ordinary account holders, this is a simple reminder that your personal information is protected by law.
What the regulator decided
The Information Regulator ruled that First National Bank, better known as FNB, broke several parts of the Protection of Personal Information Act, or POPIA. The law sets clear rules on how organisations must handle your details. You can read the Act on the South African government website.
The regulator said FNB contravened section 8 of the Act. This links to how the bank processed an account number of a data subject. A data subject is simply the person whose information is being handled.
FNB now has 30 days to respond. The bank can pay the R1 million or choose to be tried in court for the alleged offence. At this stage, it is not yet clear which route the bank will take.
The regulator also said FNB collected personal information inappropriately and did not protect it well enough. That is a serious finding for a bank, because people trust their bank with some of their most private details.
The 2022 data exposure
One key part of the case goes back to 21 February 2022. On that day, FNB confirmed a security compromise. The personal information of 88 people was exposed to 696 unauthorised individuals.
How did this happen? The regulator explained that some individual account holders were wrongly classified as employees by the bank. That label gave them access to the details of home loan applicants. They were never meant to see it.
The exposed information included full names, identity numbers and contact details. It was visible through the FNB banking app. According to the regulator, a user only had to click a list item showing a name and ID number. After that, all the personal information linked to the application would open up.
It is easy to see why this worries people. An ID number and contact details are enough to cause real trouble in the wrong hands. The issue was not a hacker breaking in. It was a system error inside the bank’s own setup, which makes it a lesson in how a small mistake can open a big door.
Collecting information from newspapers
The second problem was about how FNB gathered information. The regulator was not happy that the bank collected personal details from so called public sources. These included newspapers, company registers and online searches.
This mostly involved customers linked to politics. The bank calls them Prominent Influential Persons, or PIPs. They are also known as Politically Exposed Persons. Banks keep a closer eye on these customers as part of their anti money laundering rules. The regulator accepted that this collection is mostly in line with the bank’s own policies.
But the regulator drew a clear line between two things:
- A public record
- A public source
POPIA, in section 12(2)(a), speaks about a public record. A newspaper is not a public record, said the regulator. It also said the information in newspapers had not been deliberately made public by the person involved.
The rule here is simple. Except in certain cases, an organisation must collect personal information directly from the person it belongs to. Picking it up from the news or the internet does not meet that standard.
Keeping data for too long
The third finding was about data retention. The regulator said FNB kept some personal details indefinitely, with no clear reason.
According to the regulator, the legal basis for keeping these records was not stated in the bank’s Retention Schedule. FNB also could not explain it when asked. The regulator said keeping records longer than needed breaks section 14(1) of POPIA.
This is a point many people overlook. Even when information is collected legally, it cannot just sit in a system forever. A company must have a good reason to hold on to your details. Once that reason is gone, the data should go too.
A quick summary of the findings
| Issue | What the regulator found | POPIA section mentioned |
|---|---|---|
| Security compromise | Details of 88 people exposed to 696 unauthorised individuals in February 2022 | Section 8 |
| Collecting from newspapers | Newspapers are not a public record, so this collection was a problem | Section 12(2)(a) |
| Keeping data too long | Some details kept with no stated legal basis | Section 14(1) |
What this means for bank customers
The case shows that the Information Regulator is willing to act against big players. A R1 million fine against a major bank sends a strong message to other banks and companies that handle personal data.
For you as a customer, there are a few easy steps worth remembering:
- Check your statements often and report anything odd to your bank quickly.
- Know your rights under POPIA. You can ask how your information is used.
- Report concerns if you feel your details have been misused.
Filing a complaint is not hard. The Information Regulator is the body that handles these matters, and its website is a simple place to start.
It is also worth noting that nothing in this case suggests customers lost money because of the 2022 exposure. The regulator’s findings focus on privacy and data protection failures, not on stolen funds.
Why the first national bank popi fine matters
Many South Africans bank with FNB, and many others bank with rival institutions. Whatever bank you use, the lesson is the same. Banks hold huge amounts of sensitive information, and they must guard it properly. They must also collect it in the right way and delete it when it is no longer needed.
This case touched on all three areas. Security, collection and retention are the core pillars of POPIA. The regulator found weaknesses in each one.
The next step now sits with FNB. Will it pay the fine within 30 days, or will it take the matter to court? Either way, the outcome will be watched closely by the banking sector and by customers who want to know their data is safe.
For now, the message is clear. The law is not just words on paper. The regulator has shown it can enforce it, even against a top bank. Understanding your rights is easy, and using them can be simple too.
About the Author
