Personal information on credit card receipts to be masked by 2007

Settled case summary #25

Complaint

An individual paid for a restaurant meal with a credit card and was concerned that the credit card receipt contained her name, credit card number and the card expiry date.  She believed that the information should be masked.

Outcome

There was no question that the restaurant used electronic processing equipment that did not mask the card number, its expiry date or the cardholder’s name.  However, it was clear that the complainant’s personal information was collected, used and stored in a manner consistent with the principles outlined in the Act.  Furthermore, there was no unauthorized disclosure of the information.

The technology capable of masking or truncating numbers on receipts does exist, but many businesses have not yet converted to it.  Industry representatives advised us that, by the year 2007, all equipment used to electronically process credit card payments will mask the personal information of the cardholder.

The complainant was pleased to learn that the masking of credit card receipts would soon be an industry-wide practice, and also that the restaurant owner was aware of the privacy legislation affecting his business.  The matter was therefore considered settled during the course of the investigation.