Recommendations 02/2021 on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions

What it covers

These recommendations address the legal basis for online providers of goods and services storing customers' credit card data solely to facilitate future purchases, excluding payment institutions and recurring-payment scenarios. They examine why other Article 6 bases are inadequate and conclude that specific, freely given consent is the appropriate basis for such storage.

Why it matters

It gives a clear, narrow answer on which legal basis applies to a common e-commerce practice, useful when assessing checkout flows that offer to remember payment card details.

Refer to it when

• designing or reviewing a 'save my card' checkout feature
• assessing legitimate interest as a basis for storing financial data
• advising on consent requirements for storing payment details
• handling withdrawal of consent for stored card data

Questions this document addresses

• Can storage of credit card data for future purchases rely on contractual necessity?
• Can legitimate interest justify storing credit card data after a transaction?
• Why is consent considered the appropriate legal basis for this storage?
• What conditions must the consent meet and how is it withdrawn?

Topics

• Lawful basis
• Consent
• Security of processing