A financial institution’s responsibility to protect clients’ personal information may extend to approaching a court to stop a former employee from misusing it, according to law firm ENS.
The observation follows a recent decision by the Western Cape High Court in which Nedbank obtained an interdict against a former financial planner who retained and used client information after leaving the bank. ENS said the case illustrates how a responsible party’s obligations under the Protection of Personal Information Act (POPIA) may require active measures to safeguard information, including judicial intervention.
Aslam Moosajee and Shenaaz Munga, who are executives in ENS’s dispute resolution practice, said approaching a court may form part of what is expected of a responsible party under section 19 of POPIA, rather than merely being an optional enforcement measure.
The High Court did not expressly identify section 19 as the source of an obligation to institute legal proceedings. It found that Nedbank, as a responsible party under POPIA and custodian of the information, had a statutory duty and right to protect its clients’ information. It said the bank was required to take the necessary steps to safeguard that information, “including by approaching this Court”.
ENS linked this reasoning to section 19, which deals with security safeguards for personal information. The law firm said the custodian role “cuts both ways”: POPIA can provide a responsible party with a basis for seeking an interdict, but its responsibility for the information may also oblige it to intervene when the information is being misused.
The judgment does not establish that every loss or misuse of personal information must result in litigation. The finding arose in circumstances where the conduct was continuing and earlier interventions had failed.
Complaints followed Smit’s return to the industry
The respondent, Deon Smit, worked as a financial planner and consultant at Nedbank from February 2009 until his dismissal for dishonest conduct on 1 December 2022.
He subsequently worked as a financial planner at another financial services provider. The judgment records that he was debarred for altering a document after a client had signed it. The Financial Services Tribunal confirmed the debarment after he challenged it.
In July 2024, Smit returned to the industry as a representative. From 15 July, Nedbank began receiving complaints from clients whom he had approached.
The complaints concerned unsolicited contact by telephone, email, WhatsApp, or in person. Clients alleged that he created the impression that he remained associated with Nedbank, told them their investments required review or were performing poorly, and encouraged them to withdraw funds and reinvest through his current FSP.
They also alleged that clients were presented with forms already populated with client-specific information. In one instance, Smit allegedly sent a client a Nedbank statement dated April 2023, although he no longer worked for the bank and had neither Nedbank’s nor the client’s consent to possess it.
Smit admitted contacting Nedbank clients, discussing their investments, seeking mandates, saying the bank’s investment funds were not performing well, and advising clients to move their investments. He also admitted retaining and using client information, including information stored on his phone and his mother’s phone.
The Court noted that there was not a single instance in the record in which a Nedbank client had welcomed Smit’s approach.
Contract, POPIA, and privacy supported the interdict
To obtain a final interdict, Nedbank had to establish a clear right, actual or reasonably apprehended harm, and the absence of an adequate alternative remedy. The Court found that the bank had established all three requirements, including actual and continuing harm.
Its clear right arose partly from the confidentiality obligations in Smit’s employment contract, which survived the termination of his employment. The contract also restricted the solicitation of specified clients.
A separate basis was Nedbank’s statutory duty and right, as the responsible party under POPIA, to protect its clients’ information. The bank was also entitled to protect its proprietary business assets, goodwill, and reputation.
Smit argued that the contractual restrictions were unreasonable and effectively prevented him from earning a living. The Court found no basis for concluding that the provisions were unreasonable, unlawful, or unconstitutional. It said they required him only to conduct himself lawfully.
The information at issue included clients’ financial information and histories, identifying numbers, email and physical addresses, telephone numbers, location information, online identifiers, and personal financial preferences.
The Court found that Smit had misappropriated personal and confidential information. It said the severe intrusion into individuals’ privacy showed a disregard for the right to privacy in section 14 of the Constitution, which POPIA seeks to protect.
ENS said this demonstrated that the misuse of personal information is a constitutional privacy issue. The harm extended beyond the bank’s commercial interests to the rights of the people whose information had been retained and used.
The judgment referred specifically to Smit’s approach to an elderly woman who lived in a home and was under curatorship. The Court said there was “no doubt” that the public, including vulnerable people, needed protection from his conduct.
The Court also found that his conduct caused continuing reputational harm to Nedbank. The bank was spending resources investigating complaints and reversing unauthorised transactions.
Client complaints admitted in the interests of justice
Smit argued that client complaints not confirmed by the complainants under oath constituted inadmissible hearsay. Some clients had provided sworn statements, and two Nedbank officials supplied confirmatory affidavits regarding their receipt of the complaints and their interactions with the clients.
The Court admitted the disputed complaints under section 3(1)(c) of the Law of Evidence Amendment Act. This provision permits hearsay evidence to be admitted when doing so would be in the interests of justice after the relevant statutory factors have been considered.
In considering the nature and purpose of the evidence, the Court noted that Nedbank was acting as custodian of its clients’ information and that their interests were “severely imperiled”. It said the complaints helped it understand the extent and pattern of Smit’s conduct.
ENS said POPIA shaped the Court’s approach to the evidence. It did not create an exception to the hearsay rule, but the bank’s responsibilities as custodian formed part of the context in which the Court exercised its discretion.
The information was not confined to memory
Smit said that, to the extent that he possessed clients’ personal information, he had retained it in his memory. The Court said the contractual provisions nevertheless made his conduct unlawful.
ENS drew attention to a clause stating that all written instructions, notes, “memories”, memoranda, and records relating to confidential information that came into the financial planner’s possession remained the sole and absolute property of Nedbank and had to be surrendered on request.
Earlier measures failed
Before instituting proceedings, Nedbank sent Smit a cease-and-desist letter on 6 September 2024. The Court recorded that the letter was ignored.
The bank also circulated a warning advising clients that he was no longer employed by or representing it. On 14 November 2024, it reported his conduct to the Financial Sector Conduct Authority, but the conduct persisted.
These interventions supported the Court’s finding that the bank had no adequate alternative remedy. ENS said the case illustrated how steps taken before litigation may help an applicant satisfy this requirement for a final interdict.
A tailored data-remediation order
The order defines Protected Information as Nedbank’s non-public client names, contact details, records, mandates, investment particulars, and other personal or confidential client information obtained through Smit’s employment or access to the bank’s systems.
Information lawfully obtained independently after his employment ended is excluded from the definition.
The order prohibits Smit from retaining, using, disclosing, copying, transmitting, or making Protected Information available for soliciting or marketing financial services or procuring mandates. He may also not use client names or contact details obtained through his employment or access to Nedbank’s systems to initiate contact with those clients for these purposes.
Within 10 days, he must deliver hard-copy records containing Protected Information to Nedbank and permanently delete Protected Information from his personal electronic devices, personal email accounts, messaging applications, and cloud-storage accounts. These requirements exclude material that he is legally obliged to retain on behalf of another authorised financial-services provider.
Within 15 days, Smit must provide an affidavit confirming compliance and identifying any Protected Information not delivered or deleted. The affidavit must state the person or entity on whose behalf the information is retained, the legal basis for retaining it, and the anticipated retention period.
ENS described the relief as, in effect, a “data-remediation order”. It prohibits specified uses of the information, requires its return or deletion, and provides for verifiable confirmation of compliance.
The court also ordered Smit to pay Nedbank’s costs on Scale C, including counsel’s costs.
Lawful competition remains possible
The order does not prevent Smit from doing business with every former Nedbank client.
He may respond to contact independently initiated by a former client. He may also conduct business with a former client whose contact details were obtained lawfully and independently.
These permissions apply provided he does not use or disclose Protected Information, represent expressly or through his conduct that he is employed by, authorised by, represents, acts for, or is affiliated with Nedbank, or fail to comply with the applicable disclosure obligations when rendering financial services. He may state truthfully that he was formerly employed by the bank.
ENS said these exceptions keep the order proportionate. They target the source and use of the client information without imposing a blanket prohibition on lawful competition.
The law firm said employers should ensure their contracts contain confidentiality provisions that expressly cover clients’ personal information and survive the termination of employment. Where court action becomes necessary, responsible parties should seek tailored relief that addresses both the misuse of information and its return or deletion, supported by verifiable confirmation of compliance.
