Latvian DPA Advises Online Merchants on Data Collection Rules
Online merchants can collect only certain personal data when taking e-commerce orders, Latvia's data protection authority (DPA) said Monday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
A customer's name, last name, email address, telephone number and delivery address are required to place an order, but merchants must indicate clearly why each type of data is needed, the DPA said.
Sellers might require additional information if a product or service is tailored to a particular client, such as body size or skin type, it added.
Customer data can be used only for the original purpose it was collected, the watchdog said. It can't be transferred without a legal basis, such as consent or legitimate interest.
Data can be transferred for related purposes, such as to a courier to ensure delivery, but only if those purposes aren't contrary to the original purpose of the initial data collection, the DPA said.