Text
30 October 2020
Dear [Redacted],
Re: MASTERCARD AUTOMATIC BILLING UPDATE
We write in response to your request for an advisory opinion received by the National Privacy Commission (NPC) which sought to clarify matters regarding Mastercard’s Automatic Billing Updater (ABU) program in relation to the provisions of the Data Privacy Act of 20121 (DPA).
We understand that through the program, Mastercard will mandate issuing banks to automatically update the credit card information of cardholders through the ABU by submitting account changes to the ABU database.
On the other hand, when a cardholder transacts with merchants using updated account information, the merchants, through the acquirer may submit the account data inquiries to the ABU database which will then be processed against the issuer reported account changes, returning the results to the acquirers for the merchants to update their files thereafter.
By communicating account changes, accuracy of customer account data is maintained and there will be a reduction of preventable card-not-present declines usually caused by changes to stored payment account credentials such as changes to the account number, expiration date, or closed account notifications. Participating merchants and respective Mastercard cardholders who subscribe to the merchants’ services are automatically included in the program, with an opt-out mechanism. For card issuers however, inclusion in the automated program is mandatory.
Given the foregoing, you seek resolution for the following matters:
- Whether the opt-out mechanism for ABU is sufficient; and
- Whether Mastercard can validly mandate ABU over Philippine issuing banks.
Discussion
Relationship of Mastercard with the merchants, cardholders, and issuers
A closer look at the ABU program would reveal the interplay of several transactions between Mastercard, its merchants, cardholders and its issuing banks, among which is UnionBank. Such interplay is illustrated by Mastercard as follows:
Figure 1: Mastercard® Automatic Billing Updater2
With regard to Mastercard and its merchants, it would seem that there is no direct relationship between them since it is with the acquirer with whom the merchant enters into an agreement. While the acquirer is prescribed to limit the submission of transactions in the interchange system to those pursuant only to a Merchant Agreement or ATM Owner Agreement,3 and such terms must contain the substance of each of the standards set forth in the Mastercard Rules,4 the fact remains that the acquirer and the merchant may agree on such terms that are not in conflict with Mastercard’s standards.5
On the other hand, while the cardholders are, at first look, deemed the data subjects of the issuer, the former may also be considered the data subjects of Mastercard since both jointly determine the purposes and means of processing of the personal information of the cardholder. The issuer and Mastercard both determine what information from the cardholder is collected and the processing and extent of use of the cardholder’s personal information to effectively render their services.
Meanwhile, the relationship between Mastercard and the issuing bank may be determined by referring to Chapter 6 of the Mastercard Rules which mandates issuers to operate each of its programs in accordance with the Standards as may be in effect from time to time.6 That being the case, it is the agreement between Mastercard and the issuing bank that will govern the relationship between the two entities so long as the same is not contrary to laws, morals or public policy.
Verily, if the Agreement between Mastercard and the issuing banks mandates the mandatory inclusion in the ABU program, the same may be allowed so long as each personal information controller is aware of their responsibility and accountability for the personal information under its control or custody, including information that have been transferred to a third party for processing.
Opt-out mechanism for cardholders; lawful basis for processing of personal information; legitimate interest; data subject rights
Having established above that the issuing bank and Mastercard are controllers with regard to the personal information of the cardholders, it would seem that the basis for the processing of personal information in the ABU program stems from Section 12(f) of the DPA, or based on the legitimate interest of Mastercard and/or the issuer to reduce preventable card-not-present declines, usually caused by changes to stored payment account credentials, for transactions where there is already a card-on-file and/or for recurring payments to merchants. In this case, there is a relevant and appropriate relationship between the data subject and both controllers since the cardholder is a client of the controllers and there is a reasonable expectation at the time of the collection of the personal data that processing for that purpose may take place.7
However, both Mastercard and the issuer must determine their respective responsibilities for compliance with the obligations under the DPA, especially with regard to their respective duties to provide clear and adequate information to the data subjects regarding the ABU, as well as providing mechanisms for the data subjects to exercise their rights as provided for in the DPA. Since the basis of processing is without the explicit approval of the cardholders/data subjects, they may exercise their right to object and right to suspend, withdraw or order the blocking, removal or destruction of his or her personal data from the ABU system, should they wish to do so.
In this regard, the opt-out mechanism provided by Mastercard to its cardholders may offer the necessary means for the data subjects to exercise such rights. Mastercard and the issuer must again adequately inform data subjects of the effect of the exercise of these rights vis-à-vis the provision/continuation of services being availed of by the data subject.
Once the opt-out mechanism is chosen, the pertinent PIC/s must warrant that such personal data processing activity for the ABU is discontinued, and that sufficient safeguards are implemented to ensure that the cardholders’ personal data is erased, blocked, no longer retained, etc., as may be necessary and appropriate on a case-to-case basis.
This opinion is based solely on the limited information you have provided. Additional information may change the context of the inquiry and the appreciation of facts. This opinion does not adjudicate issues between parties nor impose any sanctions or award damages.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Footnotes
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩
-
Mastercard, Automatic Billing Updater, Streamlining account lifecycle management for credential on file and recurring payments (2020). ↩
-
Mastercard, Mastercard Rules, The Merchant and ATM Owner Agreements, paragraph 5.1 (December 19, 2019). ↩
-
Mastercard, Mastercard Rules, Required Merchant Agreement Terms, paragraph 5.1.219 (December 19, 2019). ↩
-
Ibid. ↩
-
Mastercard, Mastercard Rules, Card Issuance-General Requirements, paragraph 6.1 (December 19, 2019) ↩
-
See: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) Official Journal of the European Union, Vol. L119, Recital 47 (4 May 2016). ↩