CEO Complaint / Data protection breach

For the attention on the CEO of FNB (Jacques Celliers) Data protection compliant against FNB / CCD Couriers

In December 2018, I added a cheque account to my existing profile. Shortly afterwards I spoke to a premier banker (who was very helpful). I needed my card delivered to me before 20 December because I needed access to the account during my holiday in Cape Town. The banker explained that I’m not likely to receive the card before I leave and discussed my options with regards to the account. The banker suggested that I visit a branch and request a temporary card and wait until January to make arrangements for the actual card. I received the temp card and pin which worked well in Cape Town.

On 27 December 2018, I received a call from CCD couriers to arrange the delivery of the card. The caller introduced herself but did not verify my details in terms of the Data Protection act. Instead she only asked if my name is Sylvester Steyn to which I answered “Yes”. She then asked for my address but was not clear if the question relates to verifying my details. After seeking clarity she explained that it for delivery of the card. Having already explained to my banker that I won’t be able take delivery of the card in December I was not happy to hear that arrangements are being made to deliver my card within the next few days.

I stopped the call at this point and complained that; 1. No verification of my details were asked but the caller had already allowed me to make the arrangements. 2. I was not asked if it’s convenient to take delivery within the next few days.

I asked for a manger to call me back with regards to my complaint on 7 January 2019. It was confirmed that I will receive the call as requested. The call was not received.

On 11 January 2019, I received calls on my cell phone number and my work land line number but in both cases there was no answer and the call cut. Shortly afterwards I received an SMS to say that CCD have attempted to reach me without success.

On 12 January 2019, I received a call from CCD but it was clear from the onset that the call was not in response to my complaint. Instead it was a repeat of the call from 27 December. Again no verification was done and the caller asked for an address to deliver my card. In addition I was asked if I will take delivery of the card or if I will nominate someone else to take delivery of the card. I complained again and asked to speak to a manger. The Manger could not take my call at the time and I was offered a call back. When I asked for the time of the call back the caller said “thank you” and dropped the call. I also did not receive a reference number for the call as requested.

Surprisingly, I received a call shortly afterwards from Andile who left a voice mail message. The call back number that he left (which was also the number of the receiving call) did not work. Andile called back a short while afterwards and explained that the number that he supp**** only works from Monday to Friday. He could not explain the reason he requested me to call on a number that is not available on a Saturday. I detailed my complaint to Andile explaining that I am very concerned on the lack of data protection checks by CCD. Andile confirmed that in FNB’s agreement with CCD, no data protection check is permitted and that the caller followed the script as set out by FNB. I then proposed the following scenario.

CCD makes a call to me to arrange the delivery of the card. An unauthorized person (let’s call him Mr Smith) answers my phone. CCD asks if he is Sylvester Steyn to which he answers “yes”. CCD asks if he will take delivery of the card and he says “No”. I presume that he will then be asked to provide details of the person taking delivery. Mr Smith then provides his own details, name, ID, and delivery address. Of course CCD will not be aware of the ***** because they have NOT verified the caller. Delivery is then arranged and Mr Smith receives my card and pin, giving him access to my account.

Andile response to this by saying that the above scenario is not possible because CCD asks if they are speaking to the account holder and by the mere fact that Mr Smith angered the call proves that he is authorized.

1. All he has to say is “Yes, I am Sylvester Steyn” 2. CCD / FNB cannot control who answers my phone.

Andile confirmed that he will refer my complaint to the CEO of FNB because CCD cannot respond to my complaint .Reference number FRB ********** is given.

On 14 January, I receive a call from CCD but I was driving and asked the caller to call back after an hour. No further calls were received.

I received a call today which was just a repeat of my call with Andile on Saturday. It was then clear that my complaint has not been received by FNB. It is for this reason that I now request a response from the CEO of FNB with regards to my complaint on the Data Protection breach.

Please may I have your response ASAP.