An identity card is not a loyalty card
October 2022 – You may hardly have cash left in your wallet. But loyalty cards all the more so. With some cards, you get instant discounts. Other cards give you a record of your purchases and you will no longer get a paper ticket at the till. And finally, there are cards that allow you to collect points. Why not have everything on one card: your identity card?
Local beverage merchant
A liquor retailer offered its customers discounts based on the purchases made - in other words, a points system. But instead of offering the customers yet another plastic card, he asked them to briefly insert their identity card into the card reader.
However, a customer with principles refused to hand over his identity card, but demanded the discount. And so the matter reached the Data Protection Authority (GBA). The GBA is an independent body that monitors compliance with the basic principles of personal data protection. Those basic principles are contained in a 2016 European Regulation known as the AVG: the General Data Protection Regulation. So you can go to the GBA if you believe your privacy has been violated.
GBA and Market Court
The GBA was certainly tough on the liquor retailer.
An identity card contains a lot of information that is not relevant for a discount on drinks. Besides your full name, it also contains your date and place of birth, your gender... and also your National Register number.
The AVG is already strict as far as the use of all kinds of personal data is concerned, but the National Registry number falls under a different regulation and it is much stricter.
So while it is very tempting to use the National Register number as a unique identification number for your customers, its use for commercial purposes is also very strictly prohibited.
As a result, the GBA decided to impose a €10,000 fine on the liquor retailer
For violating the rules on minimum data collection. That is: you are not allowed to collect more data than strictly necessary; and
for lack of consent to process that data.
The Markets Court, an appeal body that includes the GBA, thought this was excessive. After all, the liquor trader had not been given the data.... So how could he have committed an offence.
Moreover, the customer had a choice, the court said. If he did not want the data to be processed, he did not have to insert the card into the card reader. The fact that he then missed out on the discount, while a consequence of that refusal, was not in itself sufficient to say that the customer had no choice.
Eventually, the case was taken to the Supreme Court. And that supreme court in our country backed the view of ... the GBA.
Nothing happened...
The initial question was whether you can file a complaint with the GBA if no offence has taken place. After all, the liquor trader had not obtained the identity card.
The Supreme Court answered in the affirmative: any person who believes that their rights under the AVG were infringed has the right to file a complaint, after which the GBA's inspectorate may or may not take action.
The fact that the personal data was not effectively processed is not an obstacle.
If the inspectorate finds that the principles in the GBA were not respected, it can take action. Here, the inspectorate found that the liquor retailer kept all data from identity cards. Most of the data so collected was not needed for the rebate.
Permission
But when a customer inserts his identity card into a card reader, is he not consenting to the processing of that data?
The Supreme Court has to take a bit of a turn there, but the conclusion is still that by taking that action here, customers are not consenting to the processing of all the data. The reasoning behind this is that by granting a discount only if the ID card is inserted into the card reader, customers are not actually given a choice. And if there is no choice, then consent is not free either.
The Market Court's reasoning that the customer did not actually lose anything, he just could not get a discount, is rejected by the Supreme Court: even the loss of a benefit results in a restriction of free choice.
Minimal data collection and alternative
Using the ID card as a loyalty card is not prohibited in itself. But the data brought in must meet the requirement of minimum data collection.
In this regard, the name seems to be just about the maximum you are allowed to read from the card. You may add some other data of your own, such as a phone number or e-mail address.
If you wish to download additional data, such as date of birth or place of residence, you will have to ask for permission to do so.
It is also not a bad idea to offer an alternative: apps where customers have to enter their own data, an old-fashioned stamp card or just another plastic card... Plenty of choices.
