CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation n° 2/RECL1/2024 of 19 January 2024 of the National Data Protection Commission, in a plenary session, on fifteen complaint files lodged against the company [REDACTED] via IMI
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the 'GDPR');
Having regard to the Act of 1 August 2018 on the organisation of the National Data Protection Commission and the General Data Protection Regime (hereinafter referred to as the 'Law of 1 August 2018');
Having regard to the Rules of Procedure of the National Data Protection Commission adopted by Decision No 3AD/2020 of 22 January 2020 (hereinafter referred to as the 'ROP');
Having regard to the complaints procedure before the National Data Protection Commission adopted on 16 October 2020 (hereinafter referred to as the 'Complaint Procedure before the CNPD');
Having regard to the following:
# I. Facts and procedure
1. In the framework of the European cooperation, as provided for in Chapter VII of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR), the Supervisory Authority of France submitted to the National Data Protection Commission (hereinafter: "the CNPD") fifteen complaints via IMI:
i. Case submitted via IMI in accordance with Article 56 procedure 61660 (national reference of the concerned authority: 190003431);
ii. Case submitted via IMI in accordance with Article 61 procedure 72549 (national reference of the concerned authority: 18023116);
iii. Case submitted via IMI in accordance with Article 61 procedure 125345 (national reference of the concerned authority: 17020150);
iv. Case submitted via IMI in accordance with Article 61 procedure 125345 (national reference of the concerned authority: 19019112);
v. Case submitted via IMI in accordance with Article 61 procedure 125345 (national reference of the concerned authority: 19020277);
vi. Case submitted via IMI in accordance with Article 61 procedure 125345 (national reference of the concerned authority: 19022084);
vii. Case submitted via IMI in accordance with Article 61 procedure 135585 (national reference of the concerned authority: 20004717);
1
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
# Deliberation n° 2/RECL1/2024 of 19 January 2024 of the National Data Protection Commission, in a plenary session, on fifteen complaint files lodged against the company [REDACTED] via IMI
viii. Case submitted via IMI in accordance with Article 61 procedure 140628 (national reference of the concerned authority: 19013514);
ix. Case submitted via IMI in accordance with Article 61 procedure 177063 (national reference of the concerned authority: 20006803);
x. Case submitted via IMI in accordance with Article 61 procedure 190551 (national reference of the concerned authority: 19007914);
xi. Case submitted via IMI in accordance with Article 61 procedure 190551 (national reference of the concerned authority: 19008433);
xii. Case submitted via IMI in accordance with Article 61 procedure 190551 (national reference of the concerned authority: 190009535);
xiii. Case submitted via IMI in accordance with Article 61 procedure 190551 (national reference of the concerned authority: 19012650);
xiv. Case submitted via IMI in accordance with Article 61 procedure 190551 (national reference of the concerned authority: 20021615);
xv. Case submitted via IMI in accordance with Article 61 procedure 190551 (national reference of the concerned authority: 21007099).
2. The complaints were lodged against the controller [REDACTED], who has its main establishment in Luxembourg. Under Article 56 GDPR, the CNPD is therefore competent to act as the lead supervisory authority.
3. All the above-mentioned complaints raise one similar issue. In essence, the complainants questioned the lawfulness for the retention of their payment card data for the purpose of facilitating further purchases (the credit card data having being stored in the account of the data subject after a first purchase on [REDACTED]'s website).
4. On this issue, the complaints are therefore based on Articles 5 and 6 GDPR.
5. On the basis of these complaints and in accordance with Article 57(1)(f) GDPR, the CNPD requested [REDACTED], in a series of meetings and exchanges of information, to take a position on the facts reported by the complainants and in particular to provide the lawful grounds for the retention of the complainant's payment card data (among others) for the purpose of facilitating further purchases.
6. The CNPD received the requested information within the several deadlines set.
2
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation n° 2/RECL1/2024 of 19 January 2024 of the National Data Protection Commission, in a plenary session, on fifteen complaint files lodged against the company via IMI
## II. In law
### 1. Applicable legal provisions
7. Article 77 GDPR provides that “without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, (...) if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.”
8. Pursuant to Article 5 (1) (a) - (f) of the GDPR, personal data shall be “processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’).
9. Pursuant to Article 5.2 of the GDPR, the controller must be able to demonstrate compliance with the requirements of the GDPR, which entails demonstrating that the interests or fundamental rights of the data subject, which require protection of personal data, do not override the interests of the controller.
10. Article 6 (1) GDPR specifies the conditions for the lawfulness of processing.
11. Article 56(1) GDPR provides that “(...) the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60”;
12. According to Article 60(1) GDPR, “The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other”;
13. According to Article 60(3) GDPR, “The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views”;
3
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation n° 2/RECL1/2024 of 19 January 2024 of the National Data Protection Commission, in a plenary session, on fifteen complaint files lodged against the company via IMI
## 2. In the present case
14. The CNPD analyzed the explanations provided by the controller with respect to the existence of a legal basis for the retention of the complainants' credit card data. The controller presented various purposes for the storage of the credit card data, such as fraud detection and prevention, establishment, exercise or defending a legal claim, compliance with tax and accounting obligations and facilitation of future purchases.
15. The controller argued that the retention is performed for these purposes on the ground of legitimate interest pursuant to Article 6 (1) (f) GDPR. Moreover, the controller stated that the retention for this purpose of facilitation of future purchases is necessary for the performance of his contractual obligations according to Article 6(1)(b) GDPR with the data subjects.
16. With regard to the storage of the credit card data for the purpose of facilitation of future purchases, the CNPD concluded that the controller failed to demonstrate the existence of a legitimate interest, the need for retention of credit card data to pursue a legitimate interest of the controller and the performance of a balancing test as required by the Recommendations 02/2021 on the legal basis for the retention of credit card data for the sole purpose of facilitating further online transactions adopted by the EDPB on 19 May 2021¹.
17. As recalled by the EDPB, for the controller to be able to rely on Article 6.1, f) of the GDPR, the three conditions laid down by this article must be satisfied²:
(i) identification and qualification of a legitimate interest pursued by the controller or by a third party;
(ii) the need to process personal data for the purposes of the legitimate interest pursued;
(iii) the performance of a balancing test (the legitimate interest of the controller or third party must be balanced against the interests or fundamental rights and freedoms of the data subject, including data subject rights to data protection and privacy).
¹ Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions adopted on 19 May 2021, available here:
https://edpb.europa.eu/system/files/2021-
05/recommendations022021_on_storage_of_credit_card_data_en_1.pdf.
² Cf. Paragraphs 7, 8 and 9 of the EDPB Recommendations 02/2021.
4
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation n° 2/RECL1/2024 of 19 January 2024 of the National Data Protection Commission, in a plenary session, on fifteen complaint files lodged against the company [REDACTED] via IMI
18. The CNPD further explained to the controller that, as provided in the Recommendations 02/2021, consent in accordance to Article 6 (1) (a) of the GDPR constitutes the sole appropriate legal basis for the retention of the credit card data for the purpose of future purchases and requested the controller to put in place the consent mechanism for the retention of the credit card data for the purpose of future purchases on all European [REDACTED] websites.
### 3. Outcome of the case
19. The CNPD, therefore considered that the controller did not comply with its obligation to demonstrate the lawfulness of the retention of the credit card data of customers for the purpose of facilitation of future payments in accordance with Article 5 (1) (b), Article 5 (2) and Article 6 GDPR.
Indeed, the controller has performed the above-mentioned processing on the basis of legitimate interest pursuant to Article 6 (1) (f) GDPR. As clarified in the Recommendations 02/2021 on the legal basis for the retention of credit card data for the sole purpose of facilitating further online transactions adopted by the EDPB on 19 May 2021, the retention of the credit card data of customers for the purpose of facilitation of future payments cannot be based on the legitimate interest pursuant to Article 6 (1) (f) GDPR.
The CNPD has therefore requested the controller to bring the concerned processing operation into compliance with Article 5 (1) (b) and Article 6 GDPR, and to implement a consent mechanism on all of [REDACTED]'s European websites.
On this background, the controller was given a strict schedule for the deployment of the proposed modifications.
20. Following this request, the controller informed the CNPD about its decision to develop and to implement the required consent mechanism in order to comply with the requirements of the GDPR.
The controller submitted the description of the implementation project which detailed the different implementation phases and deadlines for each phase and for the overall project. As requested by the CNPD, the controller submitted to the CNPD monthly reports in order to allow the monitoring of the implementation progress. The controller completed the implementation project respecting the deadline announced in the project description and has provided a final report.
Following the final implementation on 1st August 2022, the controller confirmed that when introducing a new payment method during the purchase of a product/service, credit card data is not retained
5
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation n° 2/RECL1/2024 of 19 January 2024 of the National Data Protection Commission, in a plenary session, on fifteen complaint files lodged against the company [REDACTED] via IMI
for the purpose of facilitation of future payments unless the customer has chosen to consent for the retention of his credit card data. Moreover, the controller confirmed that customers are free to finalize the purchase process without giving consent for the retention of the credit card data for the purpose of facilitation of future payments.
Furthermore, the controller revised the messages visible to customers during the purchase process, namely that:
- the purpose of saving payment method details in the context of this consent request, is solely to facilitate future purchases;
- the specific payment details that will be saved (the 16-digit card number, expiry number, name and billing address) and that they are kept securely;
- a direct link to the function allowing removal of payment details at any time from the customer's account;
- the data controller being [REDACTED];
- the data subjects will see direct links to the controller's Privacy Notice as well as a new Help Page, which states the identity of the [REDACTED] controller, the purposes for which [REDACTED] processes the customer's personal data and any third parties to whom the data may be shared with.
21. Thus, in the light of the foregoing, the controller has taken appropriate measures to ensure compliance with the GDPR, mainly by ensuring the lawfulness of the retention of the credit card data for the purpose of facilitation of future purchases by way of timely implementation of a consent mechanism.
6
CNPD
COMMISSION
NATIONALE
POUR LA
PROTECTION
DES DONNEES
Deliberation n° 2/RECL1/2024 of 19 January 2024 of the National Data Protection Commission, in a plenary session, on fifteen complaint files lodged against the company [REDACTED] . via IMI
In light of the above developments, the National Data Protection Commission, in a plenary session, after having deliberated, decides:
- To close the fifteen complaint files, on the topic of the lawfulness for the retention of the complainants payment card data for the purpose of facilitating further purchases, upon completion of its investigation, in accordance with the Complaints Procedure before the CNPD.
Belvaux, dated 19 January 2024
The National Data Protection Commission
Chair
Commissioner
Commissioner
Commissioner
## Indication of remedies
This Administrative Decision may be the subject of an appeal for amendment within three months of its notification. Such an action must be brought by the interested party before the administrative court and must be brought by a lawyer at the Court of one of the Bar Associations.
7