Since August 1, 2023, a new French regulation aimed at reducing waste has ended the systematic printing of receipts. The change comes with new rules to follow, especially on collecting customer data and obtaining consent. What does it really mean, and what options do merchants have? Here is an overview.
Which receipts are affected by the end of systematic printing?
Under Article L. 541-15-10, IV, 1° of the French Environmental Code, the ban on systematic printing and distribution applies to:
- Till receipts
- Card payment receipts
- Receipts issued by vending machines and kiosks
- Vouchers, promotional and discount tickets
What are the merchant's obligations?
Give customers a choice
Merchants must now offer customers several options for their receipts:
- No receipt: customers can choose not to receive one at all.
- Paper receipt: customers can still ask for a printed receipt.
- Digital receipt: merchants must offer to send the receipt electronically, for example by email or SMS.
If your customer chooses the third option, strict personal data protection obligations apply, as explained below.
What digital receipts mean for personal data protection
Digital receipts can involve additional processing of personal data, for example to send the receipt by SMS or email. This means collecting and storing information such as phone numbers and email addresses. In this context, the CNIL makes sure digital receipt practices respect data protection principles and consumer rights.
What is the role of the CNIL?
The Commission nationale de l'informatique et des libertés (CNIL) is the French data protection regulator. It helps private and public organizations comply with data protection rules. The CNIL handles complaints from individuals and can carry out inspections, on site or online. It can order an organization to bring its processing into compliance, or impose sanctions such as fines.
Digital receipts: the rules to follow according to the CNIL
Inform customers about how their data is used
Merchants must inform customers clearly and transparently about how their personal data is used. This can be done in two ways:
- A short notice at the checkout: display a brief explanation at the till so customers are informed straight away.
- Full information available through a QR code: in addition to this first level of information, provide a QR code customers can scan to read a complete explanation of how their data is processed.
Limit data collection
If the merchant sends digital receipts, it should favor solutions that limit, or even avoid, the collection of personal data. For example, retrieving a receipt by scanning a QR code only requires the data needed to establish the connection. The CNIL encourages these techniques and recommends using them. When personal data is collected, it must be adequate, relevant and limited to the defined purposes.
Limit how long data is kept
The retention period for personal data must be set according to the purpose of the processing and any applicable legal obligations. In most cases, the law does not set a specific period, so the data controller must define it. Data typically goes through several stages:
- Active storage: data is kept and accessible for the purpose of the processing, in day-to-day use.
- Intermediate archiving: once data is no longer needed for that purpose, it can be stored and made accessible only for administrative needs (disputes, accounting, fraud, and so on).
- Final archiving: data is kept long term for legal or historical reasons, but is no longer used in day-to-day operations.
To help you, the CNIL has published a practical guide to retention periods (in French).
Secure access to data
Data security must be guaranteed with robust protection measures that ensure its integrity, availability and confidentiality. It is also essential to prevent disclosure to unauthorized third parties by making sure only authorized people can access the data.
Make it easy to object to the reuse of contact details
If contact details are collected when a digital receipt is issued, customers must not be subscribed to marketing communications automatically. Customers must be able to give their consent, or easily object to the reuse of their contact details, in particular for marketing communications about the merchant's products and services. Merchants must provide clear and accessible ways to exercise this right, such as an opt-out option at the time of collection or an unsubscribe link in marketing messages. This way, customers stay in control of how their personal data is used. Note that sharing personal data with business partners always requires the customer's consent.
The Wallet Crew: a way to respect customer data protection rules in store
The Wallet Crew lets merchants deliver receipts directly into customers' mobile wallets. Customers can create an account without sharing personal data, add it to their wallet and find all their receipts in one place. They receive a notification when a new receipt is added to their wallet, which makes it easy to keep track of purchases.
The Wallet Crew also connects with several digital receipt solutions, including:
- Cegid
- Eyos
- Yocuda (Global Blue)
- Billiv
Limit personal data processing without losing touch with customers
The Wallet Crew uses technologies that minimize personal data processing while keeping the relationship with customers. Customers simply show a unique, confidential code from their wallet to identify themselves at the checkout, without sharing personal data. They can also sign up and log in with Sign in with Apple and the Hide My Email option for extra protection.
Stay in control of data storage
The Wallet Crew does not store customer data: it passes it directly to the merchant's system or CRM (Cegid Retail, Salesforce, and others). Merchants keep control of where data is stored and avoid duplicating it.
Minimize personal data processing
Merchants collect only the data they need to reach their goals, with no mandatory data fields imposed by the platform.
Collect customer consent easily
The platform makes it easy to collect customer consent with opt-in checkboxes and the relevant information notices. The information needed to comply with privacy regulations is provided transparently, with a template available to merchants. It also makes it easy for customers to exercise their rights over their personal data (update, deletion, objection, and so on) directly from their wallet.
