EDPB 02/2021 (Rec.)

Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions

Sets out that storing a customer's credit card data after a purchase, solely to make future online transactions easier, requires the data subject's consent under Article 6(1)(a) GDPR and cannot rely on contractual necessity or legitimate interests.

Reproduced from official EDPB publications for reference. Not legal advice.