The Information Regulator has fined FNB R1 million after a misconfigured setting in its banking app let 696 customers see the home loan applications of 88 other people, and the bank failed to fix the flaw after customers reported it twice. The regulator announced the fine on 27 October, alongside a R500,000 fine against Central Johannesburg TVET College.

"FNB did not address this vulnerability to the confidentiality of personal information even after two alerts by two parties who were mindful of the fact that they should not have been able to have access to such personal information," it said, describing the bank's handling as "lackadaisical".

The exposure happened in 2022. Some customers had been wrongly classified in FNB's systems as bank employees, which gave them access in the app to a list of names and ID numbers of people with home loan applications in progress. Clicking a name opened the full application, including contact details, home address, income and salary information, and in nine cases, bank account numbers.

A customer alerted FNB on 30 March 2022, and a second on 3 May 2022. Each time, the regulator found, FNB removed that person's access but treated it as an isolated incident rather than a breach of personal information, and did not report it. The regulator only stepped in after a complaint in September 2022.

The R1-million fine itself is for the offence linked to exposing bank account numbers. The regulator warned the exposed data put customers at risk of identity theft, SIM-swap fraud and attempts to get past banks' identity checks, especially combined with credit bureau data from earlier Experian and TransUnion breaches already circulating online. The enforcement notice goes further than the app.

The regulator found FNB could not lawfully rely on newspapers as a source of personal information under the section of POPIA it cited, because a newspaper is not a "public record" as the act defines it.

FNB gathers such information mainly to screen politically exposed persons for anti-money-laundering checks, and must now document another legal basis or stop. Its records schedule also allowed some personal information to be kept indefinitely without a legal reason, so it must appoint a records company to destroy those records. And it must rewrite its privacy notice, which relied on grounds such as "legitimate interest" to share customers' data that the regulator says are not valid under POPIA. FNB has 90 days to show it has complied and 30 days to appeal.

TechCentral reported the enforcement notice, signed by regulator chair Pansy Tlakula, and said it had asked FNB whether it would appeal. SABC News first reported the fines and quoted Hangi Mbedzi, the regulator's acting senior manager for POPIA, saying they reflected the seriousness of the breaches and the risk to the people affected.

R1 million is small for a bank of FNB's size. The useful part is what the regulator spelt out, because each finding applies to ordinary businesses too.

First, a customer telling you they can see someone else's data is a breach, not a support ticket, and must be investigated and reported. Second, permissions errors are a common cause of leaks, so check who your systems treat as staff. Third, "it was in the newspaper" or "it was public" is not automatically a legal reason to collect someone's information, which matters for any business scraping public sources or building AI tools on them. Fourth, keeping data forever is a risk, not a safety net, the same lesson behind the Ampath breach.

And if your privacy notice leans on "legitimate interest" to share customer data, this ruling suggests it is time for a legal review. The regulator is clearly willing to name and fine large organisations, as our coverage of POPIA and AI at work anticipated.

You might also like our piece on the RelyComply breach, FNB's crypto trading launch, and protecting your bank account.

Get more SA tech and business news and subscribe to The Open Letter.