On 19 May 2021, the European Data Protection Board adopted Recommendations on the legal basis for the storage of credit card data for the sole and specific purpose of facilitating further online transactions. They cover the situation where a data subject buys products or pays for a service via a website or an application, and provides credit card data, generally on a dedicated form to conclude the transaction.
The Recommendations go through all the 6 legal bases permitted under the GDPR to determine the lawful legal basis for the storage of credit card data following a purchase, in order to facilitate further purchases. It concludes that consent is the sole appropriate legal basis in this situation.
Let’s look at the consent principles highlighted by the EDPB:
- Consent must be free, specific, informed and unambiguous.
- Consent must be delivered by a clear affirmative action.
- Consent should be requested in a user-friendly way such as through a checkbox, directly on the form used for the data collection. Such a checkbox should not be pre-ticked.
- Consent for storing credit card data for facilitating further purchases must be distinguished from the consent given for terms of service or of sales and not be a precondition to the completion of the transaction.
- Data subjects should have the right to withdraw consent at any time. The withdrawal must be free, simple and as easy for the data subject as it was to give consent.
- Withdrawal of consent must lead to the effective deletion of credit card details stored for the sole purpose of facilitating further transactions.
This indicates that online retailers must not store credit card information after a purchase has taken place without the consent of the data subject. Such consent must meet the standards laid down in the GDPR and the requirements of the EDPB.
Now let’s look at EDPB’s comments on other lawful legal basis for the storage of credit card details following a transaction:
| Lawfulness of Processing (Article 6 GDPR) |
| Legal Basis |
EDPB’s comments |
| Compliance with a legal obligation |
The storage of credit card data following a transaction, in order to facilitate further purchases, cannot be considered necessary for compliance with a legal obligation. |
| Protection of vital interests of natural persons |
The storage of credit card data following a transaction, in order to facilitate further purchases, cannot be considered necessary for the protection of vital interests of natural persons. |
| Performance of a task carried out in the public interest |
The performance of a task carried out in the public interest or the exercise of official authority vested in the controller cannot be considered as an adequate legal basis in this scenario. |
| Performance of a contract |
Whereas, in the first place, the processing of the data related to the credit card used by the data subject to pay is necessary to fulfil the contract, the storage of such data is only useful in order to facilitate the potential next transaction and facilitate the sales. Such a purpose cannot be considered as strictly necessary for the performance of the contract for the provision of the good or service that the data subject has already paid. |
| Legitimate interests of the controller/third-party |
The three conditions must be satisfied under GDPR
- A legitimate interest pursued by the controller or by a third-party, to be present and effective at the date of the data processing.
- The need to process personal data for the purposes of the legitimate interest pursued.
- The legitimate interest of the controller or third-party must be balanced against the interests or fundamental rights and freedoms of the data subject.
The test fails on the second and third conditions according to EDPB.
|
| Data subject’s consent |
Consent appears to be the sole appropriate legal basis for the above-described processing to be lawful. |
While analyzing the three conditions required for satisfying the legal basis of legitimate interests of the controller (or a third-party), the EDPB emphasizes that it is not evident whether or not the data subject will be making another purchase in this specific context. The balancing test requires taking into consideration the particular circumstances of the processing, the potential impact on the data subject’s rights and freedoms, and the reasonable expectations of data subjects. The EDPB notes that since credit card data is highly personal, its processing to facilitate further purchases may involve an increased risk of credit card data security breaches. Moreover, the data subject does not reasonably expect his or her credit card data to be stored for longer than what is necessary to pay for the goods or services he/she is buying. As a result, the conditions required may not be fulfilled and the legitimate interests of the controller (or a third-party) may not be an appropriate legal basis to process data.
Therefore, businesses and online retailers must obtain the data subject’s valid consent before storing their credit card details after a purchase, for the sole purpose of facilitating further transactions. The EDPB also emphasizes the need to put in place the appropriate safeguards for data subjects to decrease the risk of unlawful data processing and foster trust in the digital environment.
