“The Australian community expects financial service providers, and indeed all organisations, to
be proactive in protecting the personal information they hold,” Australian Information Commissioner and Privacy Commissioner Angelene Falk said.

“Our inquiries identified deficiencies in CBA’s management of personal information, specifically its internal access controls and approach to retention and destruction," she said.

CBA said it had reported both of the incidents to the OAIC, and was working to address the problems.

“We have offered this EU as a demonstration of our continued commitment to appropriately managing the privacy of customer personal information, and addressing any concerns identified by the Commissioner," chief risk officer Nigel Williams said in an announcement to investors.

“We continue to take action to address issues, earn trust and be a better bank for our customers. This includes proactively engaging with our regulators to ensure we continue to build better systems, processes and controls to manage the personal information of our customers.”

In the 2016 incident, a contractor to CBA lost two magnetic tapes that contained customer statements between 2000 to 2016  that belonged to about 20 million customers. CBA commissioned a report into the matter, which concluded the tapes were probably destroyed.

Even so, the OAIC last year looked into whether CBA had improved its practices, and the watchdog found the bank was not clearly setting out how long it would keep types of personal information.

Its systems and procedures to destroying personal information once it was no longer needed were also not up to scratch.

The 2018 incident involved CBA finding out that its life insurance business had 16 applications that contained customer information, which could have been accessible to employees that were outside the life insurance business.

The OAIC said no evidence of unauthorised access to these applications had been reported, but CBA did not have sufficient controls to review and monitor access to personal information across its business.