Privacy watchdog blows back customer card provider via identity card: “intrusive” and “non-transparent”

The MyFreedelity app offers a digital system for loyalty cards and receipts. The service is linked to the identity card. The card is read in participating stores, so that the company saves time and does not have to fill in unnecessary forms. Large chains such as MediaMarkt, Medi-Market, Pizza Hut and Prik & Tik use the system.

However, the Data Protection Authority judges that the company is going too far. The regulator has determined that Freedelity does not provide sufficient guarantees for consumer consent. For example, some retailers pressure customers to accept the terms and conditions in exchange for commercial benefits and data is not collected transparently.

The central storage of this information poses a major privacy risk for millions of consumers

Data Protection Authority

In addition, the company also appears to collect data such as the identity card number, the validity date and the issuing municipality – data that is not necessary for their services. The central storage of this information poses a major privacy risk for millions of consumers, it is said.

Penalty payments

The privacy watchdog has given Freedelity four months to adjust its working methods. The company must ensure that it unequivocally obtains consent from consumers and provide an easy way to withdraw that consent. In addition, Freedelity must remove unnecessary personal data and reduce the retention period from eight to a maximum of three years.

In the event of non-compliance, Freedelity risks penalty payments of up to 5,000 euros per day. The company has 30 days to appeal the decision.

“Witch Hunt”

CEO Sebastien Buysse reacts strongly against the privacy watchdog. He is concerned that the procedure has been dragging on since 2019. “Our last hearing was in April and yet GBA published the decision the day before Black Friday, which is no coincidence,” he says. He speaks of a witch hunt against his company and denounces “crazy requests”, such as providing access to the source code of their system.

Freedelity would be targeted because it is “growing too fast”. “We have been processing data from more than seven million Belgians for fifteen years and no admissible complaint has ever been submitted.” Buysse will appeal against the decision.