Service providers charging customers' credit cards: not to use credit card data of terminated accounts - DPP3.
The Complaint
A customer subscribed to the Internet service of a telecommunications company and used her credit card to pay for the charges. She subsequently terminated the Internet account with the company. A year later, the customer registered with the telecommunications company for its IDD service and chose to settle the bills by cash payment. There was a default on payment of her IDD bill and the company resorted to the use of the customer's credit card information to charge the outstanding amount. On learning of this the customer made a complaint to the PCPD.
Findings of the Privacy Commissioner
An investigation by the PCPD revealed that the customer had not been informed of such use of her credit card information at the time of collection of the data by the telecommunications company. Further, it was held that it was not within a consumer's reasonable expectation for the credit card information, provided in conjunction with a terminated account, to be used for payment of services under a different account. No express consent had been obtained from the customer and the company was found to have changed the use of the credit card data in contravention of DPP3.
Action by the Privacy Commissioner
An enforcement notice was served on the company requiring it to cease such practice of using the customers' credit card data.