Is it legal for a business to store and use my payment information in a way that I can&#39;t edit, remove, or otherwise control?
<p>I recently moved from a townhouse where I used Waste Management for my trash and recycling pick up. The apartment I moved into takes care of trash so last month I canceled the service, got a phone confirmation, and even took the extra step of removing my payment information from the website.
What I see in the online portal is:
<a href="https://i.stack.imgur.com/RTx4e.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/RTx4e.png" alt="enter image description here" /></a></p>
<p>All services are not showing and section is greyed out, autopay shows enroll option showing I unenrolled, and is grayed out to reflect no services available for autopay. And further, probably more importantly here, in the manage payment methods section:
<a href="https://i.stack.imgur.com/c1Ly6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/c1Ly6.png" alt="enter image description here" /></a></p>
<p>Clearly no payment method saved.
Both of these views on the website have shown me this for weeks. Now in this case I'm assuming it's a software bug. I've already cleared it up with Waste Management (customer service rep looked into it, said it showed me still in auto pay on their system, took it out and refunded the extra charge that let me find out this was happening. Another set of bugs in that even if I was enrolled in autopay, if there are no services scheduled, it shouldn't be billed anyway, but less relevant here). Hopefully not too much background... I assumed when I deleted my saved credit card numbers they were no longer available to Waste Management in anyway, yet clearly they were saved in another capacity to continually be used like this.</p>
<p>Is it legal for a business to store and use my payment information in a way that I can't edit, remove, or otherwise control?</p>

<p>A company may retain information to comply with legal obligations, exercise legal claims or rights, or defend legal claims. Maintaining the ability to charge and refund on a credit card is within the scope of their right to retain information. I would not assume that &quot;removing payment method&quot; deletes the data from their database, it means that you can no longer use that method of payment. See <a href="https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&amp;sectionNum=1798.105." rel="nofollow noreferrer">this section</a> of Cal. Civ. and <a href="https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&amp;sectionNum=1798.145." rel="nofollow noreferrer">this section</a>. A company would need to retain the information somewhere in case there was a reasonable explanation of a charge-back.</p>

united-states privacy california payment ccpa