What is it about?
The principle of data minimization pursuant to Art. 5 para. 1 lit. c GDPR states that personal data must be adequate and relevant to the purpose and limited to what is necessary in relation to the purposes of the processing.
The DSK points out that customers in online commerce should also have the option of ordering via guest access, irrespective of the provision of a customer account.
According to the DSK, with few exceptions, the creation of a permanent customer account is not necessary for the fulfillment of the contract. Accordingly, the legal basis for such a customer account can only be a consent pursuant to Art. Art. 6 para. 1 lit. a, Art. 9 para. 2 lit. a GDPR.
Pursuant to Art. 7 para. 4 GDPR in conjunction with Recital 43 consent shall not be deemed to have been given voluntarily if the performance of a contract is dependent on consent, even though such consent is not necessary for performance.
Accordingly, ordering in online commerce (fulfillment of contract) may not be made dependent on the creation of a permanent customer account (consent) and an equivalent ordering option or guest accessmust be offered.
A guest account not only dispenses with access data (user name/password), but also with the continuous storage of customer data and order history as well as other optional data in the productive store system.
The fulfillment of legal retention obligations in connection with an order should take place in a separate system (restricted) anyway.
The evaluation of the contract history for advertising purposes as well as the continued storage of the means of payment can also only take place with informed consent in the context of a permanent customer account.
The distinction between guest access and continued (permanent) customer account as well as the legal basis applicable in each case (contract fulfillment / consent) must be presented to customers in a transparent manner when the data is collected.
In addition to the information obligations pursuant to Art. 13 GDPR the consent to a permanent customer account, including the evaluation of the contract history for advertising purposes and the permanent storage of means of payment, must be given in an informed manner.