General Data Privacy Regulation

Subscribe to General Data Privacy Regulation via RSS

Many companies negotiate contracts containing merchant of record designations without fully appreciating the significance of that designation from a privacy and data security perspective.

For purposes of this article, the merchant of record is the party that both contracts directly with the payment processor and holds the direct consumer relationship for the transaction. The MoR is the business the consumer knows, interacts with, and sees on the cardholder billing statement. This is the traditional direct-merchant model, distinct from platform arrangements…
Continue Reading The Merchant of Record (MoR) Designation Has Significant Privacy and Data Security Implications

side-view-adult-paying-with-card-640x427

In the payments world, commentators note Illinois’ recent Interchange Fee Prohibition Act, which prohibits charging interchange fees on the tax or tip portions of processed transactions.

Key portions of the law take effect July 1.

By its terms, the Interchange Fee Prohibition Act also contains a general privacy rule restricting the use of payments transactional data:

(b) An entity, other than the merchant, involved in facilitating or processing an electronic payment transaction, including, but not limited to, an issuer…

Continue Reading Payments and Privacy – What Issues Should Payment Service Providers Be Paying Attention To?

The EU General Data Privacy Regulation (GDPR) was adopted in 2016 and went into effect on May 25, 2018. The GDPR is a framework regulation that is designed to provide a uniform regime to protect the privacy of an individual of the European Union (“data subject”) whose personal data is collected, stored, or processed.

The GDPR is extremely broad in scope. Accepting or processing payments may be classified as the collection and processing of personal data under the GDPR. As such, any company involved in processing payments from consumers should take steps to determine whether they or any of their business partners are collecting, storing, or processing personal information of a data subject.
Continue Reading GDPR Applicability to U.S. Merchants, Processors and Acquirers