The PDPC had received enquiries from individuals about merchants swiping the magnetic stripes of the payment cards after payment had been processed through the use of the embedded microchips on the cards. The act of accessing personal data stored in a payment card, through any microchip, magnetic stripe reader or any other means, constitutes collection of the personal data under the PDPA, even if the personal data is retained only temporarily by the merchant. Merchants will have to ensure that the collection and use of the personal data in a payment card complies with the obligations in the PDPA.

Click here to find out more.