A glitch in big-four bank First national Bank's (FNB's) mobile app has exposed personal information of customers applying for home loans using the digital platform. It was discovered that if an FNB client used the mobile app to apply for a home loan, they would easily see the personal details of other home loan applicants. The exposed data includes personal identifiable information, such as names, identity numbers and contact details. An FNB client who discovered the exposed data has since informed the Information Regulator, asking it to take the necessary measures against the big-four bank.

Question

"I wish to lodge a complaint against First National Bank in respect to a breach of personal information through their banking application," the client reported to the regulator.
"Whilst applying for a home loan through the service,
I noticed that I was able to access other individuals' personal information, such as ID numbers, contact details and various financial information, which is visible to other applicants, including my personal information.
"I have documented this by way of screenshots and have evidence to support this data breach.
I believe my rights in terms of the POPI Act [Protection of Personal Information Act] have been infringed and poses a huge personal security risk," stated the client.
"Your e-mail contents have been noted and will be addressed with the responsible party," says a complaints and investigations officer of the Information Regulator in an e-mail.Under South Africa's data privacy law, the Protection of Personal Information Act (POPIA), organisations must inform the Information Regulator if they expose the personal information of data subjects to unauthorised third parties without their approval. FNB has acknowledged exposing the personal information of its clients, saying it is in the process of notifying the relevant authorities, as well as those who have been impacted.
While the financial institution has rushed to disable the app functionality in question, it did not disclose how many customers were impacted.
Says the bank in a statement: "FNB is aware of a technical error that made the information of certain home loan applicants, such as full names and ID numbers, visible to other home loan applicants who logged in via our digital channels.
FNB takes the privacy and protection of customer information very seriously, and the affected functionality has since been temporarily disabled to resolve the root cause of the issue.
We are in the process of contacting the affected customers and the appropriate regulator.
Customers requiring any assistance can contact us through Secure Chat on the FNB app."
ENB recently made sweeping changes to its brand, including a redesign of its popular banking app.
The FNB app, introduced more than a decade ago, saw its active transacting base exceed 4.7 million customers, based on results for the year ended 30 June 2022.
The data exposure comes at a time the Information Regulator is receiving an unprecedented number of reports about data breaches in South Africa.
Speaking during the Governance, Risk and Compliance 2023 conference last week, advocate Pansy Tlakula, chairperson of the Information Regulator, revealed that data breaches are a big problem in this country - much bigger than people think. "Every public body, every private body that has suffered a security compromise or data breach has to notify us - there is no threshold. Even if one person was breached, they still have to notify us. If you look at 500 (it's 564 to be precise), it means that in a month, this country suffers about 56 data breaches - major and minor ones," she revealed. "I think we are one of the highest in the world with data breaches..Apply your knowledge of the governance of the risk management programme to discuss the three (3) layers of involvement to manage information risk in the above FNB case.write an answer for 10 marks in two lengthy paragraphs

Answer 1

In the case of the data breach experienced by First National Bank (FNB), effective information risk management requires a multi-layered approach that encompasses governance, operational risk management, and technological safeguards. The first layer involves governance, which entails establishing a framework to ensure that cybersecurity policies and practices align with regulatory requirements, such as the Protection of Personal Information Act (POPIA). Organizations like FNB must have a strong governance structure, involving senior leadership, compliance teams, and data protection officers who are responsible for overseeing privacy policies to prevent unauthorized access to personal information. This governance framework should also include training for employees on data protection protocols and the importance of safeguarding sensitive customer information, creating a culture of awareness and accountability throughout the organization.

The second layer focuses on operational risk management, emphasizing the processes and procedures that monitor and control information-related risks. FNB must conduct regular risk assessments to identify vulnerabilities in its digital platforms and implement robust incident response plans that can be activated in the event of a data breach. This includes developing a structured communication strategy to promptly inform affected customers and regulators about data breaches, nurturing transparency and trust. The third layer involves technological safeguards, which encompasses deploying advanced security measures such as encryption, access controls, and anomaly detection systems to protect customer data from unauthorized access. Continuous monitoring and testing of the digital infrastructure should be performed to ensure that any potential risks are detected and mitigated before they can breach customer security. Together, these layers of involvement play a crucial role in managing information risk effectively and protecting sensitive customer information against potential threats.