1

I recently moved from a townhouse where I used Waste Management for my trash and recycling pick up. The apartment I moved into takes care of trash so last month I canceled the service, got a phone confirmation, and even took the extra step of removing my payment information from the website. What I see in the online portal is: enter image description here

All services are not showing and section is greyed out, autopay shows enroll option showing I unenrolled, and is grayed out to reflect no services available for autopay. And further, probably more importantly here, in the manage payment methods section: enter image description here

Clearly no payment method saved. Both of these views on the website have shown me this for weeks. Now in this case I'm assuming it's a software bug. I've already cleared it up with Waste Management (customer service rep looked into it, said it showed me still in auto pay on their system, took it out and refunded the extra charge that let me find out this was happening. Another set of bugs in that even if I was enrolled in autopay, if there are no services scheduled, it shouldn't be billed anyway, but less relevant here). Hopefully not too much background... I assumed when I deleted my saved credit card numbers they were no longer available to Waste Management in anyway, yet clearly they were saved in another capacity to continually be used like this.

Is it legal for a business to store and use my payment information in a way that I can't edit, remove, or otherwise control?

2 Answers 2

3

A company may retain information to comply with legal obligations, exercise legal claims or rights, or defend legal claims. Maintaining the ability to charge and refund on a credit card is within the scope of their right to retain information. I would not assume that "removing payment method" deletes the data from their database, it means that you can no longer use that method of payment. See this section of Cal. Civ. and this section. A company would need to retain the information somewhere in case there was a reasonable explanation of a charge-back.

5
  • 1
    You miss the really obvious reason they need to keep it - it was used in an actual transaction that they are legally obliged to keep records of for tax and accounting reasons.
    – Dale M
    Commented Jul 21, 2020 at 21:08
  • Appreciate the answers guys - on the question format, is it too much background/too much about a specific situation? I wanted to provide detail to make the exact intent of the question more clear, but felt I may have strayed from necessity at times. New here, probably will never be the most active member, but value any feedback.
    – TCooper
    Commented Jul 22, 2020 at 3:13
  • 3
    @DaleM: While tax and accounting may require a business to store who paid them, it will generally not require the business to store credit card numbers, routing numbers, etc.
    – Brian
    Commented Jul 22, 2020 at 16:27
  • a random upvote brought me back here - I'm curious, they obviously have a right to store it, but do they have a right to charge it again after I've removed it as a payment method? I know this is separate from the question in the title
    – TCooper
    Commented Dec 2, 2020 at 23:26
  • Subscriptions and auto-renewal services are notoriously problematic because you have consented to something, and they may make it difficult to withdraw consent. If this was e.g. an online onetime purchase of soap, they can't then use the card to charge you for cans of tuna that you didn't order. In case of dispute, they may say "you didn't withdraw consent". leginfo.legislature.ca.gov/faces/… says what they can and can't do.
    – user6726
    Commented Dec 3, 2020 at 1:13
-2

Merchants who process credit cards are required to follow the PCI-DSS (Payment Card Industry Data Security Standards) and the Operating Rules of their card brand association (Visa, MasterCard, Amex, etc.) The associations have want to honor clauses in their agreements that prohibit giving more favorable terms or treatment to a competing card brand. So for a example, a merchant who accepts Visa, MasterCard and American Express must follow the same offers in each card brand. Visa is the most pro-consumer of the three card brand rule sets in that not only has it adopted the latest revision of the PCI-DSS standards, which is 4.0 (effective March 1, 2024)

PCI-DSS FAQ 1038 addresses the question of the storage of expired payment accounts numbers (PCI-DSS also covers bank accounts too) which states:

Entities should retain PAN based on business/legal needs, as defined in their data retention policy (PCI DSS Requirement 3). Remember: If you don’t need it, don’t store it

Account numbers should be encrypted and limited in access (PCI-DSS 2.0 or higher - standards 6 and 12)

Since 2018 the Visa/MasterCard stored payment credential rules prohibit storing the full card number and outlines rules for agreements regarding stored payment credentials. A VALID stored payment credential agreement requires acceptance by the cardholder of the following terms:

  • A truncated version of the stored credential, like the last four digits of a credit card
  • The method by which the cardholder will be notified of any changes to the agreement
  • How and under what conditions the stored credential will be used
  • The expiration date of the agreement (when applicable)

The short answer is: NO. After initial enrollment, the full card number CANNOT be stored.

Non-compliance can result in sanctions ranging from chargeback up to merchant account restriction or termination.

3
  • this does not address the legal situation. Legal means laws, not private regulations such as the PCI security standard.
    – Trish
    Commented Sep 18, 2023 at 21:43
  • The contract for merchant processing is governed by the brand associations. When a merchant violates the operating rules, it is in breach of contract. Breach of contract is a valid cause of action. In 2020, the National Automated Clearinghouse Association joined the council and adopted PCI-DSS security standards for electronic funds transfers in the United States. This includes the Federal Reserve Bank System (sponsor of the regional clearinghouse networks.
    – mobiledork
    Commented Sep 19, 2023 at 0:55
  • Subsequently, in 2020, the Federal Trade Commission as enforcer of consumer financial privacy protections in the Gramm Leach Bliley Act as amended, issued the Safeguards rule (effective 2021), adopting PCI-DSS as the regulatory standard for consumer financial information protection.
    – mobiledork
    Commented Sep 19, 2023 at 0:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .