iOn 15 November 2017 the CNIL created a special page on its website with a view to highlighting its 2013 guidelines on processing of payment card data for online transactions (The 2013 guidelines were modified in July 2017).
The guidelines highlight the following:
- The permitted purposes some of which have to be presented as separate to the data subject (e.g. retaining data for card fraud detection) or require a separate consent (e.g. retaining data or for future transaction),
- The necessary data (identity of the cardholder is not one of them, except for fraud prevention),
- The retention periods (in any event, the cryptogram cannot be retained after the transaction)
- Information of the data subjects
- Security measures
