Stop printing debit/credit card numbers
David Fraser has a posting in his PIPEDA and Canadian Privacy Law blog called Putting together the pieces. It brings together two practical issues.
Stores should not print full debit/credit card numbers on receipts – or indeed on their own copies. (The transaction has already been approved – so they don’t need to keep it – and those numbers should not be available to anyone.)
And stripping out personal information to anonymize information has always been fraught with the risk that the information could be recreated by combining it with other information.
Businesses that print only partial numbers don’t consistently print the same portions – thus receipts can be combined to re-create the full number.
As David concludes: Perhaps the debit terminal manufacturers and distributors could get together and figure this out. Perhaps the credit/debit card suppliers should take some action on this as well.
