'Most Innovative Startup 2020' by RSA - Watch the video

Learn More

On 19 May 2021, the European Data Protection Board adopted Recommendations on the legal basis for the storage of credit card data for the sole and specific purpose of facilitating further online transactions. They cover the situation where a data subject buys products or pays for a service via a website or an application, and provides credit card data, generally on a dedicated form to conclude the transaction.

The Recommendations go through all the 6 legal bases permitted under the GDPR to determine the lawful legal basis for the storage of credit card data following a purchase, in order to facilitate further purchases. It concludes that consent is the sole appropriate legal basis in this situation.

Let’s look at the consent principles highlighted by the EDPB:

  • Consent must be free, specific, informed and unambiguous.
  • Consent must be delivered by a clear affirmative action.
  • Consent should be requested in a user-friendly way such as through a checkbox, directly on the form used for the data collection. Such a checkbox should not be pre-ticked.
  • Consent for storing credit card data for facilitating further purchases must be distinguished from the consent given for terms of service or of sales and not be a precondition to the completion of the transaction.
  • Data subjects should have the right to withdraw consent at any time. The withdrawal must be free, simple and as easy for the data subject as it was to give consent.
  • Withdrawal of consent must lead to the effective deletion of credit card details stored for the sole purpose of facilitating further transactions.

This indicates that online retailers must not store credit card information after a purchase has taken place without the consent of the data subject. Such consent must meet the standards laid down in the GDPR and the requirements of the EDPB.

Now let’s look at EDPB’s comments on other lawful legal basis for the storage of credit card details following a transaction:

Lawfulness of Processing (Article 6 GDPR)
Legal Basis EDPB’s comments
Compliance with a legal obligation The storage of credit card data following a transaction, in order to facilitate further purchases, cannot be considered necessary for compliance with a legal obligation.
Protection of vital interests of natural persons The storage of credit card data following a transaction, in order to facilitate further purchases, cannot be considered necessary for the protection of vital interests of natural persons.
Performance of a task carried out in the public interest The performance of a task carried out in the public interest or the exercise of official authority vested in the controller cannot be considered as an adequate legal basis in this scenario.
Performance of a contract Whereas, in the first place, the processing of the data related to the credit card used by the data subject to pay is necessary to fulfil the contract, the storage of such data is only useful in order to facilitate the potential next transaction and facilitate the sales. Such a purpose cannot be considered as strictly necessary for the performance of the contract for the provision of the good or service that the data subject has already paid.
Legitimate interests of the controller/third-party The three conditions must be satisfied under GDPR

  1. A legitimate interest pursued by the controller or by a third-party, to be present and effective at the date of the data processing.
  2. The need to process personal data for the purposes of the legitimate interest pursued.
  3. The legitimate interest of the controller or third-party must be balanced against the interests or fundamental rights and freedoms of the data subject.

The test fails on the second and third conditions according to EDPB.

Data subject’s consent Consent appears to be the sole appropriate legal basis for the above-described processing to be lawful.

 

While analyzing the three conditions required for satisfying the legal basis of legitimate interests of the controller (or a third-party), the EDPB emphasizes that it is not evident whether or not the data subject will be making another purchase in this specific context. The balancing test requires taking into consideration the particular circumstances of the processing, the potential impact on the data subject’s rights and freedoms, and the reasonable expectations of data subjects. The EDPB notes that since credit card data is highly personal, its processing to facilitate further purchases may involve an increased risk of credit card data security breaches. Moreover, the data subject does not reasonably expect his or her credit card data to be stored for longer than what is necessary to pay for the goods or services he/she is buying. As a result, the conditions required may not be fulfilled and the legitimate interests of the controller (or a third-party) may not be an appropriate legal basis to process data.

Therefore, businesses and online retailers must obtain the data subject’s valid consent before storing their credit card details after a purchase, for the sole purpose of facilitating further transactions. The EDPB also emphasizes the need to put in place the appropriate safeguards for data subjects to decrease the risk of unlawful data processing and foster trust in the digital environment.

It is worth noting that the Recommendations do not cover payment institutions operating in online stores or public authorities. These EDPB Recommendations are not relevant where the credit card data is stored to comply with a legal obligation or establish a recurring payment, for example, a contract that stipulates the supply of a certain good every month or the subscription for a music or movie streaming service.

Securiti’s Universal Consent Management Solution enables organizations to capture consent and automate consent revocation. Ask for a DEMO today to understand how Securiti can help you comply with consent requirements of global data privacy laws and regulations, with ease.

Share this

Our Videos

privacy policy and notice management View More
02:26

Dynamic Privacy Policies & Notices

Automatically Update & Refresh Your Policies and Notices

Learn More
View More
02:37

Universal Consent & Preference Management

Simplify and automate universal consent management

Learn More
View More
01:53

Cookie Consent Management

Automate and manage the entire consent life cycle with efficiency for various cookie compliance regulations around the world.

Learn More
View More
3:06

Sensitive Data Intelligence

Discover granular insights into all aspects of your privacy and security functions while reducing security risks and lowering the overall costs

Learn More
View More
3:11

Data Mapping Automation

Simplify gathering information, dynamically update your data catalog, and automate assessments and reports

Learn More
View More
02:40

An IT Leader’s Perspective on CCPA

Meet Brian Lillie, Former CPO at Equinix as he discusses the potential challenges of CCPA and how the PrivacyOps framework can be the key to unlocking compliance.

Learn More