The end of automatic receipt printing: what will change?
Initially provided for by Law no. 2020-105 of February 10, 2020 on the fight against waste and the circular economy (“AGEC Law”), with an application date of January 1, 2023 at the latest, the end of automatic printing and deletion of receipts has been slow to be implemented.
The implementing decree for this provision was only published on December 14, 2022, and its entry into force is finally scheduled for April 1, 2023. Beyond the operational aspect, and the technical constraints that this abolition may generate for professionals, this change raises many questions about the respect of consumer rights in terms of personal data, and the precautions and measures that will have to be put in place by professionals in this respect.
Implementation of the ban on the systematic printing and distribution of sales receipts and the like
Article L541-15-10 IV of the Environment Code provides that “By January 1, 2023 at the latest, unless otherwise requested by the customer, the following are prohibited:
1. The systematic printing and distribution of till receipts in sales outlets and establishments open to the public;
2. The systematic printing and distribution of bank card receipts;
3. Systematic printing and distribution of tickets by vending machines;
4. The systematic printing and distribution of vouchers and tickets to promote or reduce the price of sales items in sales outlets.”
This ban applies to all sectors and is therefore general in scope. It can only be disregarded if the consumer requests that their ticket be printed.
This prohibition therefore applies to tickets given to consumers for transactions carried out directly at the point of sale and outside e-commerce, whether these are in-store till receipts, bank card receipts or receipts given by vending machines, or vouchers and tickets used to promote or reduce the price of in-store items.
Of course, this does not mean that professionals should refrain from keeping proof of purchase. On the one hand, they must be able to accommodate customer requests to provide a paper copy of their purchase receipt, the law providing for an exception to the ban in the event of a “customer request to the contrary”. On the other hand, by default, economic operators will have to supply receipts in digital format instead of paper versions. These will be sent by SMS, e-mail, message in the buyer’s banking application, or even by QR code, which implies the collection of the buyer’s personal data, and undeniably raises data protection issues.
In this respect, and to avoid any confusion for the consumer, the implementing decree of December 14, 2022 requires professionals to post signs near checkouts or vending machines, legibly and comprehensibly stating that “except in the case of legal exceptions, the printing and delivery of cash register and bank card receipts will only be carried out at the consumer’s request”.
In addition, implementing decree no. 2022-1565 of December 14, 2022 sets out several exceptions to the ban on printing till receipts:
- sales receipts relating to the purchase of so-called “durable” goods, such as household appliances or IT equipment, on which the existence and duration of the legal guarantee of conformity is indicated, in accordance with article D211-7 of the French Consumer Code;
- cancelled or unsuccessful credit card transactions, or transactions subject to pre-authorization or credit, which, for security reasons, give rise to the printing of a ticket given to the consumer;
- tickets issued by vending machines, which must be kept and presented in order to benefit from a product or service and, where applicable, to calculate the amount due in return;
- receipts or other billing documents printed by non-automatic weighing instruments. These include, for example, scales made available to consumers in supermarkets.
Focus on compliance with personal data processing obligations
Aside from the legal exceptions listed above, retailers must collect personal data from consumers at checkout, so that they can send them the various tickets. On this point, the Decree of December 14, 2022 makes no reference to the personal data that may be collected.
However, the digital version of the ticket, notably by SMS or email, cannot be sent without collecting contact information from the consumer, which can only be an email address or a mobile phone number, information that is indisputably personal data.
The ban on the printing of till receipts therefore creates a new typology of personal data processing whose legal basis, in accordance with Article 6 c) of Regulation (EU)No. 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, (hereinafter the “RGPD”), is the need to comply with the legal obligation set out in Article L541-15-10 of the Environmental Code. This processing will not in fact be based on the consumer’s consent since the law provides by default that the consumer consents to the processing and that failing this the processing is not authorized since the ticket will then be printed.
In view of the above, it will be necessary to provide for processing methods adapted to this legal basis and the corresponding purpose, in order to ensure its lawfulness. We will come back below to two manifestations of this constraint, compliance with which is essential.
Firstly, in accordance with the principle of data minimization set out in Article 5 c) of the RGPD, only the data necessary to transmit the ticket in digital form should be collected, i.e. only a telephone number or email address and the first and last names of the person concerned. This prohibition on the printing of sales receipts does not authorize retailers to require consumers to transmit other personal data (postal address, date of birth).
Even more so, the ban on the printing of till receipts in no way authorizes professionals to use the data thus collected for purposes other than sending out the till receipt, for example, for commercial prospecting and to populate their CRM files. In the same way, retailers will not be authorized to systematically create loyalty accounts for all their customers, as loyalty programs constitute a purpose other than that of complying with the provisions of the Environment Code.
Secondly, in accordance with Article 5 e) of the RGPD, it will be appropriate to retain the data collected only for the time necessary to transmit the ticket to the consumer. In a strict interpretation, this duration should be very short and it could be considered that the data collected must be deleted as soon as the consumer receives the ticket in digital form. However, this period could be insufficient to enable the retailer to demonstrate that they have complied with their obligation to transmit a sales receipt to the consumer. In any case, intermediate storage may be necessary. Determining how long the data collected for the purpose of transmitting digital sales receipts to consumers should be kept must therefore be carefully analyzed on a case-by-case basis.
In addition to these points of attention, retailers will have to comply with all the obligations of the RGPD concerning this new processing, and in particular the obligation of security or that of informing data subjects of the purposes of the processing they are implementing and of respect for their rights.
Aware of this difficulty, the CNIL has indicated that it will shortly issue a ruling on the terms and conditions for implementing this processing. We can only hope that these clarifications will be made before April 1, 2023. In the meantime, we strongly advise you not to wait, and to start thinking right now about how to secure the personal data that will be collected internally.
Our lawyers are at your disposal to answer all your questions and advise you. Our meetings can be held face-to-face or by videoconference. You can make an appointment directly online at www.agn-avocats.com.
AGN AVOCATS – Distribution Department
09 72 34 24 72
