EDPB recommends collecting consent to store credit card details for future transactions

On 19 May 2021, the European Data Protection Board adopted Recommendations on the legal basis for the storage of credit card data for the sole and specific purpose of facilitating further online transactions. They cover the situation where a data subject buys products or pays for a service via a website or an application, and provides credit card data, generally on a dedicated form to conclude the transaction.

The Recommendations go through all the 6 legal bases permitted under the GDPR to determine the lawful legal basis for the storage of credit card data following a purchase, in order to facilitate further purchases. It concludes that consent is the sole appropriate legal basis in this situation.

Let’s look at the consent principles highlighted by the EDPB:

• Consent must be free, specific, informed and unambiguous.
• Consent must be delivered by a clear affirmative action.
• Consent should be requested in a user-friendly way such as through a checkbox, directly on the form used for the data collection. Such a checkbox should not be pre-ticked.
• Consent for storing credit card data for facilitating further purchases must be distinguished from the consent given for terms of service or of sales and not be a precondition to the completion of the transaction.
• Data subjects should have the right to withdraw consent at any time. The withdrawal must be free, simple and as easy for the data subject as it was to give consent.
• Withdrawal of consent must lead to the effective deletion of credit card details stored for the sole purpose of facilitating further transactions.

This indicates that online retailers must not store credit card information after a purchase has taken place without the consent of the data subject. Such consent must meet the standards laid down in the GDPR and the requirements of the EDPB.

Now let’s look at EDPB’s comments on other lawful legal basis for the storage of credit card details following a transaction:

While analyzing the three conditions required for satisfying the legal basis of legitimate interests of the controller (or a third-party), the EDPB emphasizes that it is not evident whether or not the data subject will be making another purchase in this specific context. The balancing test requires taking into consideration the particular circumstances of the processing, the potential impact on the data subject’s rights and freedoms, and the reasonable expectations of data subjects. The EDPB notes that since credit card data is highly personal, its processing to facilitate further purchases may involve an increased risk of credit card data security breaches. Moreover, the data subject does not reasonably expect his or her credit card data to be stored for longer than what is necessary to pay for the goods or services he/she is buying. As a result, the conditions required may not be fulfilled and the legitimate interests of the controller (or a third-party) may not be an appropriate legal basis to process data.

Therefore, businesses and online retailers must obtain the data subject’s valid consent before storing their credit card details after a purchase, for the sole purpose of facilitating further transactions. The EDPB also emphasizes the need to put in place the appropriate safeguards for data subjects to decrease the risk of unlawful data processing and foster trust in the digital environment.