¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
Thank you for your email of 22 January 2018.
Our view
I have considered the information available in relation to this
complaint and I am of the view that has complied with its
data protection obligations.
You have explained that following receipt of our email you looked at
both customer’s – (“Customer A”) and
(“Customer B”) – histories in its fraud engine. You provided us with
the following information:
1. Both customers logged on from the same device (Device ID
) – Customer A logged onto this
device on the 11 July 2018 and the 26 July 2018, Customer B
logged onto this device on the 30 July 2018.
2. Both customers have logged on from the same IP address: IP
Address – Customer A logged on from this IP
address on the 26 July 2018, Customer B logged on from this
IP address on the 30 July 2018.
You have also explained that a user’s account on the
website does not store payment card details. Instead, “payment
tokens” are stored in a database – a payment token is a unique
identifier for a payment card. Your organisation’s fraud engine and
its payment gateway will each give a payment card a payment
token. Payment tokens are not shared with users.
It is my understanding that the fraud engine will give a payment
card the same payment token even if that payment card is used by
many different accounts or users. They payment gateway will give
each individual account a separate token even if several accounts
use the same payment card.
If a user transacts on the website, payment tokens are used to
make a call to the payment gateway. Of a user’s 15 or 16 digit card
number (depending on the card type), the only information that is
logged in a user’s account and that a user would see are the last
two digits of their payment card.
We are satisfied with the response you have provided and based on
the information we now have available it appears likely that the
data subject has used the same device as a third party.
We will now close this case with no further action. Thank you for
your cooperation whilst we dealt with the matter.
Yours sincerely
Lead Case officer
Information Commissioner’s Office
ICO Statement
You should be aware that the Information Commissioner often
receives request for copies of the letters we send and receive when
dealing with casework. Not only are we obliged to deal with these in
accordance with the access provisions of the data protection
framework and the Freedom of Information Act 2000, it is in the
public interest that we are open and transparent and accountable
for the work that we do.
For information about what we do with personal data see our
privacy notice at www.ico.org.uk/privacy-notice