DPE-2026-0025

Transactiegegevens buiten de betaalketen

Gegevens over een betaling bereiken partijen die geen rol spelen in het uitvoeren ervan.

Familie
Keten
Status
actief
Geldt voor
web, mobile-app, firmware, iot

Wat er gebeurt

At the moment a payment is initiated or confirmed, the system reports it to parties outside the chain that executes it: what was bought, the amount, an order reference, and an identifier for the customer or the device. In a browser or an app this is a measurement or advertising component; at a terminal or till it is a reporting integration alongside the payment path. The same shape occurs outside retail: a public body reporting each step of a transaction, with a case reference and a status, to a marketing or analytics party.

Waarom het ertoe doet

What someone buys is among the most revealing records there is, from medicines to political membership dues. A payment involves the payer, the merchant and the parties that move the money; everyone else is an addition the person cannot see, at a moment when they are concentrating on paying rather than on who is watching.

Veelvoorkomende oorzaken

  • a purchase event sent to an advertising component to attribute a campaign
  • basket contents included in an analytics event because the template offered the field
  • a loyalty or reporting integration in a till system that forwards line items
  • funnel steps of a payment or application flow reported to an analytics party, keyed to a long-lived identifier

Dit is het níet

Parties that execute the payment, such as the acquirer, the scheme or the issuer, are not this entry. Nor is an internal record kept by the merchant. The distinguishing feature is a recipient with no role in executing the payment receiving what was bought or what it cost, tied to an identifier.

Hoe je het vaststelt

Indicator

At payment confirmation, a request to a host under a registrable domain belonging to neither the merchant nor a party in the payment chain, carrying the amount, an order reference or item identifiers together with a customer or device identifier.

Methode

network-with-identifier

Kwaliteit van de detectie

88 van 100

De grenzen van deze bevinding

Wat dit patroon zou weerleggen

  • The recipient is part of the payment chain, such as an acquirer, gateway or fraud-prevention party under contract for that purpose.met de hand te toetsende bevinding vervalt
  • The transmitted event carries no identifier and no line detail, only that a purchase occurred.machinaal te toetsende bevinding wordt zwakker
  • The recipient acts strictly as a processor for the merchant and does not use the data for its own purposes.niet uit de meting af te leidende bevinding krijgt een ander patroon
  • The reporting only fires after consent was registered and refusing removes it.machinaal te toetsende bevinding wordt zwakker

Wat dit patroon níet vaststelt

  • harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
  • severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
  • unlawfulness; that is for a supervisory authority or a court
  • intent; a fault is usually a build decision, not a plan
  • absence: not finding it in one capture is not evidence that it is not there

Reproduceren

  • manualMETHOD.mdno dedicated reproduction exists yet; follow the general method and the indicator above

Juridisch kader

Bepalingen

eu-gdpr-6-1-aeu-gdpr-5-1-ceu-gdpr-9-1

Veelgehoorde tegenwerpingen

It is only an order total, not personal data.

It travels with an identifier and an order reference, which is what makes it usable. Amount plus identifier plus time is a record about a person.

We need it to measure our advertising.

That is a purpose for the merchant, not a role in the payment. It has to stand on its own basis, and the person has to be able to refuse it without failing to pay.

The item description is generic.

Test it against the actual payload. Where the line detail names the product, the objection is answered by the capture.

Geldt wanneer

to-processing

Aangetroffen in

De onderzoeken waarin dit patroon gemeten is.

Verwante patronen

← alle patronen