A glitch in big-four bank First national Bank's (FNB's) mobile app has exposed personal information of customers applying for home loans using the digital platform. It was discovered that if an FNB client used the mobile app to apply for a home loan, they would easily see the personal details of other home loan applicants. The exposed data includes personal identifiable information, such as names, identity numbers and contact details. An FNB client who discovered the exposed data has since informed the Information Regulator, asking it to take the necessary measures against the big-four bank. "I wish to lodge a complaint against First National Bank in respect to a breach of personal information through their banking application," the client reported to the regulator. "Whilst applying for a home loan through the service, I noticed that I was able to access other individuals' personal information, such as ID numbers, contact details and various financial information, which is visible to other applicants, including my personal information. "I have documented this by way of screenshots and have evidence to support this data breach. I believe my rights in terms of the POPI Act [Protection of Personal Information Act] have been infringed and poses a huge personal security risk," stated the client. "Your e-mail contents have been noted and will be addressed with the responsible party," says a complaints and investigations officer of the Information Regulator in an e-mail.Under South Africa's data privacy law, the Protection of Personal Information Act (POPIA), organisations must inform the Information Regulator if they expose the personal information of data subjects to unauthorised third parties without their approval. FNB has acknowledged exposing the personal information of its clients, saying it is in the process of notifying the relevant authorities, as well as those who have been impacted. While the financial institution has rushed to disable the app functionality in question, it did not disclose how many customers were impacted. Says the bank in a statement: "FNB is aware of a technical error that made the information of certain home loan applicants, such as full names and ID numbers, visible to other home loan applicants who logged in via our digital channels. FNB takes the privacy and protection of customer information very seriously, and the affected functionality has since been temporarily disabled to resolve the root cause of the issue. We are in the process of contacting the affected customers and the appropriate regulator. Customers requiring any assistance can contact us through Secure Chat on the FNB app." FNB recently made sweeping changes to its brand, including a redesign of its popular banking app. The FNB app, introduced more than a decade ago, saw its active transacting base exceed 4.7 million customers, based on results for the year ended 30 June 2022. The data exposure comes at a time the Information Regulator is receiving an unprecedented number of reports about data breaches in South Africa. Speaking during the Governance, Risk and Compliance 2023 conference last week, advocate Pansy Tlakula, chairperson of the Information Regulator, revealed that data breaches are a big problem in this country - much bigger than people think. "Every public body, every private body that has suffered a security compromise or data breach has to notify us - there is no threshold. Even if one person was breached, they still have to notify us. If you look at 500 (it's 564 to be precise), it means that in a month, this country suffers about 56 data breaches - major and minor ones," she revealed. "I think we are one of the highest in the world with data breaches."POPIA sets down firm frameworks that companies have to abide by to avoid fines, criminal persecution and potential reputation loss. Breaching the rules and regulations outlined by this Act can have serious financial implications for the business - repercussions that can cost a fortune and have long-lasting consequences, such as reputational damage. The Act makes provision for fines of up to R10 million and a jail sentence of up to 10 years, depending on the seriousness of the breach.Identify the risk treatment criteria that can be applied at the strategic level by FNB, in the above case, to document all risks, where consequences for the firm could be dire, as well as emerging risks that could cause larger troubles in the future if they are not monitored carefully?Write an answer for 10 marks.Strategic layer,Tactic layer,Operational level These are the layers

Answer 1

To address the risks associated with the data breach incident involving First National Bank's (FNB) mobile app, it is essential to define risk treatment criteria at various organizational levels: Strategic, Tactical, and Operational. Below is an analysis of the criteria that can be applied specifically at the Strategic Level, which focuses on the overall direction and governance of the organization.

Strategic Level Risk Treatment Criteria (10 Marks)

1. Comprehensive Risk Assessment Framework:

   • FNB should establish a robust risk assessment framework that comprehensively identifies, assesses, and documents all potential risks associated with digital platforms. This framework should include not only current risks from existing applications, like the home loan function in the mobile app, but also emerging risks related to technological advancements, regulatory changes, and evolving cybersecurity threats.

2. Data Protection Governance:

   • The bank needs to strengthen its data governance structure by appointing a dedicated Data Protection Officer (DPO) and forming a cross-functional data protection committee. This committee should be tasked with overseeing compliance with data protection regulations (such as POPIA), formulating policies around data security, and ensuring that appropriate controls are in place to safeguard customer information.

3. Monitoring and Reporting Mechanism:

   • Implement strategic monitoring systems that enable real-time tracking of data access and potential breaches. The organization should also define a reporting protocol for internal audits and frequent assessments of data protection measures. This will help to promptly identify and remediate vulnerabilities, ensuring ongoing compliance with regulatory frameworks.

4. Employee Training and Culture of Compliance:

   • FNB should develop and implement a comprehensive training program to foster a culture of data protection awareness across the organization. Employees must be educated on the importance of data privacy, the implications of breaches, and the policies in place to protect customer information. An informed workforce can act as the first line of defense against potential data breaches.

5. Stakeholder Engagement and Communication Strategy:

   • Establish a clear communication strategy that engages all stakeholders, including customers, regulators, and shareholders, regarding data security initiatives and breach responses. Transparency about risks, response measures, and remedial actions reinforces trust and enables better stakeholder relationships.

6. Strategic Partnerships with Cybersecurity Experts:

   • To enhance its resilience against future data breaches, FNB should consider forming strategic partnerships with cybersecurity firms. These partnerships can provide access to advanced security technologies and expertise that help in proactively identifying vulnerabilities and defending against cyber threats.

7. Incident Response and Crisis Management Plan:

   • Develop and regularly update an incident response plan that prepares the organization for swift action in the event of a data breach. The plan should outline roles, responsibilities, and procedures for managing data breaches efficiently while minimizing negative impacts on the business and customers.

8. Regular Review of Compliance and Reformulation of Policies:

   • The organization should conduct regular reviews of its data protection policies and compliance with the POPIA to ensure they reflect the current regulatory landscape and technological environment. Adjustments must be made promptly to accommodate any increasing risks or changes in legislation.

9. Evaluation of Technological Infrastructure:

   • FNB ought to evaluate and invest in its technological infrastructure to ensure that its systems can handle sensitive customer data securely. This may include implementing encryption, access controls, and other security technologies to protect data.

10. Long-term Risk Monitoring and Scenario Planning:

• Implement ongoing risk monitoring processes that not only track current threats and vulnerabilities but also incorporate scenario planning for potential future risks related to emerging technologies (such as AI and IoT) and their implications for data security.

Conclusion

By applying these strategic-level risk treatment criteria, FNB can significantly enhance its ability to manage existing risks and proactively address emerging threats related to customer data protection. This approach not only aligns with regulatory requirements but also promotes consumer trust, enhancing the bank's overall reputation while safeguarding its operational integrity.