3

I work for a company where we take credit card payments for the services we provide.

As per the Card Scheme rules, the cardholder can request a charge-back up to (in the case of Visa) 13 months after the transaction, at which point we are required to provide any data we collected about the transaction to prove that the cardholder initiated the transaction (data that, by definition, personally identifies the individual). If we are unable to satisfactorily prove that the cardholder was involved, we are considered at fault and the price of the sale is refunded to the cardholder.

I have recently been reviewing the EU GDPR regulations to determine what we need do in order to become compliant. Article 17 covers the "Right to Erasure", requiring us to remove data about an individual on request.

My concern is that someone may invoke the GDPR "Right to Erasure", then initiate a charge-back on a sale. This will leave us unable to provide any information on the sale and so we'll be automatically at fault.

The GDPR states (Article 17, Paragraph 3):

  1. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: ... (e) for the establishment, exercise or defence of legal claims."

Except at the point the right to erasure is invoked, there is no legal claim to be established or defended.

Is the possibility of a charge-back at some point in the future (and therefore the defence of a legal claim in future) sufficient to reject an individuals "Right to Erasure" under the GDPR?

Improve this question

1 Answer 1

Reset to default
2

In general, you allowed to keep data that evidences contractual dealings - this would include methods of payment. Indeed, tax law requires you to keep this data for some number of years and employment records can (and should) be kept in perpetuity.

Improve this answer
3
  • Ah ok, so this relates back to Article 6 "Lawfullness of Processing". So if processing is "lawful" only because they gave consent (Article 6, clause 1a) and they withdraw their consent (Article 17, clause 1b), the data has to be erased. However, if the processing remains "lawful" after they remove their consent (such as "processing is necessary for the performance of a contract" from Article 6, clause 1b as you mentioned) then the last part of Article 17, clause 1b "... and where there is no other legal ground for the processing" means we can ignore them. Many thanks
    – Trevor
    Nov 10, 2017 at 13:07
  • Actually this is not completely clear from the wording. The contract is between the merchant and the credit card acquirer, and not the merchant and end-customer. Does Art 6. 1(a) allow this (i.e. contract between data controller and some 3rd party needs to be upheld, hence PII can't be deleted)?
    – Saurabh Nanda
    May 21, 2018 at 20:11
  • @SaurabhNanda there are 3 contracts here: merchant-customer, customer-CC provider, Merchant-CC provider
    – Dale M ♦
    May 21, 2018 at 20:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .