Retaining card details withour permission

[Surfer01]

Recently we made a booking on Brittany Ferries and paid a deposit after reading the T & Cs.

 

 

On receiving the itinery we noticed that it said that the balance would automatically be debited from the card used to pay the deposit.

 

At no time did we give them permission to retain our card details and it is not mentioned in the T & Cs at all.

 

 

Can they retain your card details although they were never given permission?

[citizenB]

I didn't think they were permitted to retain your card details. Once the transaction has been completed, they should be removed.

 

 

How do they know that you would want to pay the balance via that account ? You might want to use another credit card/debit card account or even a cheque or online transfer ?

[citizenB]

https://www.theguardian.com/money/2009/mar/20/consumer-affairs

 

13.7 Can an organisation retain my credit card / bank account details after I close my account with that organisation?

 

 

Section 2(1)©(iv) of the Acts provide that "the data shall not be kept for longer than is necessary for that purpose or those purposes [for which it was obtained]". Where the purpose for which the information was obtained has ceased and the personal information is no longer required, the data must be deleted or disposed of in a secure manner. Information should never be kept 'just in case' a use can be found for it in the future.

 

The Data Protection Acts do not specify a maximum retention period and accordingly it is a matter for the data controller to decide on an appropriate retention policy based on the circumstances and the reason why the information is being retained. We would not generally raise an issue from a data protection perspective with a retention policy that provides for banking information to be retained for a short period following termination of a customer contract in order to deal with any subsequent queries about payments made on the account/closing balances etc. We would not expect that such companies would be required to delete a person's bank details immediately when a person requests the closure of their account.

 

 

 

 

13.8 Can an organisation re-use my retained credit card information for a subsequent purpose?

 

 

Where personal data stored on a credit/debit card is collected for the purpose of a transaction, unless it is clearly stated, it can be assumed that the purpose for its collection ends following a certain period following completion of the payment for a product or service (to allow for follow-up payment related queries).

 

Where an organisation retains personal data for automatic renewal of a subscription service, we would expect the customer to have agreed in some way to this further processing. Where an organisation can point to an ongoing customer relationship and where it is using payment details in line with the terms and conditions which it outlined at the time the person signed up for the product/service, then the use of the credit card details in an auto-renewal transaction will not likely give rise to a data protection issue.

 

https://www.dataprotection.ie/docs/Data-Protection-in-the-Banking-and-Insurance-Sectors/1249.htm

 

 

[Surfer01]

I didn't think they were permitted to retain your card details. Once the transaction has been completed, they should be removed.

 

 

How do they know that you would want to pay the balance via that account ? You might want to use another credit card/debit card account or even a cheque or online transfer ?

 

Thanks. That is our issue.

We paid the deposit with a NW debit card

however will be paying the balance through HSBC.

 

 

I was quite surprised that they would retain the card details for a period of 3 months in one case

and with the other booking nearly 8 months especially as we never gave them permission to retain them in the first place.

 

 

As Brittany ferries is a French company although reputable it does create a concern.

[citizenB]

I think it might be in your interest to either email/write (with PoP) or telephone and make sure you record the call. Advise them that you would prefer they didn't keep that particular card on file as you will not be paying the balance with it.

 

 

Once you have that on record, should they make any attempt to withdraw funds then you might have cause for a complaint against them.

[Surfer01]

Thanks will do.