Can a company base the collection and processing of credit card information upon the performance of a sales contract?

Bryan Cave Leighton Paisner


The GDPR anticipates that a company may process personal data as long as one (or more) of six lawful purposes applies.1  One of those lawful purposes relates to the collection of personal data about a person as part of performing a contract with that person. 

The Article 29 Working Party – the predecessor to the European Data Protection Board – recognized that a company is processing data for the purposes of performing a contract when it “processes credit card details in order to facilitate payment” for a good or service.2  Arguably, the collection and maintenance of salary and payment details might also be based upon the legitimate interest of a merchant and a customer to the extent that an argument is made that the use of credit card information is not strictly necessary to complete a transaction (e.g., currency or a check could also presumably be used), but acceptance of credit card offers convenience to both parties.

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. GDPR, Article 6(1)(a)-(f).

2. WP 259 Rev. 01 at 8

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Bryan Cave Leighton Paisner | Attorney Advertising

Written by:

Bryan Cave Leighton Paisner

Bryan Cave Leighton Paisner on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.