I work for a company where we take credit card payments for the services we provide.
As per the Card Scheme rules, the cardholder can request a charge-back up to (in the case of Visa) 13 months after the transaction, at which point we are required to provide any data we collected about the transaction to prove that the cardholder initiated the transaction (data that, by definition, personally identifies the individual). If we are unable to satisfactorily prove that the cardholder was involved, we are considered at fault and the price of the sale is refunded to the cardholder.
I have recently been reviewing the EU GDPR regulations to determine what we need do in order to become compliant. Article 17 covers the "Right to Erasure", requiring us to remove data about an individual on request.
My concern is that someone may invoke the GDPR "Right to Erasure", then initiate a charge-back on a sale. This will leave us unable to provide any information on the sale and so we'll be automatically at fault.
The GDPR states (Article 17, Paragraph 3):
- Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: ... (e) for the establishment, exercise or defence of legal claims."
Except at the point the right to erasure is invoked, there is no legal claim to be established or defended.
Is the possibility of a charge-back at some point in the future (and therefore the defence of a legal claim in future) sufficient to reject an individuals "Right to Erasure" under the GDPR?