'Most Innovative Startup 2020' by RSA - Watch the videoLearn More
Published on June 2, 2021 AUTHOR PRIVACY RESEARCH TEAM
On 19 May 2021, the European Data Protection Board adopted Recommendations on the legal basis for the storage of credit card data for the sole and specific purpose of facilitating further online transactions. They cover the situation where a data subject buys products or pays for a service via a website or an application, and provides credit card data, generally on a dedicated form to conclude the transaction.
The Recommendations go through all the 6 legal bases permitted under the GDPR to determine the lawful legal basis for the storage of credit card data following a purchase, in order to facilitate further purchases. It concludes that consent is the sole appropriate legal basis in this situation.
Let’s look at the consent principles highlighted by the EDPB:
This indicates that online retailers must not store credit card information after a purchase has taken place without the consent of the data subject. Such consent must meet the standards laid down in the GDPR and the requirements of the EDPB.
Now let’s look at EDPB’s comments on other lawful legal basis for the storage of credit card details following a transaction:
|Lawfulness of Processing (Article 6 GDPR)|
|Legal Basis||EDPB’s comments|
|Compliance with a legal obligation||The storage of credit card data following a transaction, in order to facilitate further purchases, cannot be considered necessary for compliance with a legal obligation.|
|Protection of vital interests of natural persons||The storage of credit card data following a transaction, in order to facilitate further purchases, cannot be considered necessary for the protection of vital interests of natural persons.|
|Performance of a task carried out in the public interest||The performance of a task carried out in the public interest or the exercise of official authority vested in the controller cannot be considered as an adequate legal basis in this scenario.|
|Performance of a contract||Whereas, in the first place, the processing of the data related to the credit card used by the data subject to pay is necessary to fulfil the contract, the storage of such data is only useful in order to facilitate the potential next transaction and facilitate the sales. Such a purpose cannot be considered as strictly necessary for the performance of the contract for the provision of the good or service that the data subject has already paid.|
|Legitimate interests of the controller/third-party||The three conditions must be satisfied under GDPR
The test fails on the second and third conditions according to EDPB.
|Data subject’s consent||Consent appears to be the sole appropriate legal basis for the above-described processing to be lawful.|
While analyzing the three conditions required for satisfying the legal basis of legitimate interests of the controller (or a third-party), the EDPB emphasizes that it is not evident whether or not the data subject will be making another purchase in this specific context. The balancing test requires taking into consideration the particular circumstances of the processing, the potential impact on the data subject’s rights and freedoms, and the reasonable expectations of data subjects. The EDPB notes that since credit card data is highly personal, its processing to facilitate further purchases may involve an increased risk of credit card data security breaches. Moreover, the data subject does not reasonably expect his or her credit card data to be stored for longer than what is necessary to pay for the goods or services he/she is buying. As a result, the conditions required may not be fulfilled and the legitimate interests of the controller (or a third-party) may not be an appropriate legal basis to process data.
Therefore, businesses and online retailers must obtain the data subject’s valid consent before storing their credit card details after a purchase, for the sole purpose of facilitating further transactions. The EDPB also emphasizes the need to put in place the appropriate safeguards for data subjects to decrease the risk of unlawful data processing and foster trust in the digital environment.
It is worth noting that the Recommendations do not cover payment institutions operating in online stores or public authorities. These EDPB Recommendations are not relevant where the credit card data is stored to comply with a legal obligation or establish a recurring payment, for example, a contract that stipulates the supply of a certain good every month or the subscription for a music or movie streaming service.
Securiti’s Universal Consent Management Solution enables organizations to capture consent and automate consent revocation. Ask for a DEMO today to understand how Securiti can help you comply with consent requirements of global data privacy laws and regulations, with ease.