GDPR - access to transaction data
<p>Is it within my rights as a user of a payment service like Paypal or Western Union, to ask for the full details of a transaction that I did (namely the card number of the recipient) ?</p>
<p>edited : bank account -&gt; card number</p>

<p>If the receiving account is not your account, then information about it is not your personal information, so the GDPR right to view your PI held by the data controller would not apply, I believe. It may well be that the payment service would provide this information, but I dion't thin k that the GDPR would require it to do so. Some other law might also apply, however.</p>

<h2>Payment service regulations, not GDPR</h2>
<p>I do not think that GDPR is the appropriate legal act for this goal, instead you should look at your rights regarding the payment process as such. They should be specified in your contract with your payment service provider (&quot;Paypal or Western Union&quot;), however, they all should be similar with respect to these rights as for example, the Payment Services Directive (PSD 2, EU Directive  2015/2366) Article 57 requires the payment service provider to provide the payer all kinds of information on the individual transactions.</p>

<p>If this is your personal data and no exception applies, then you are entitled to receive this information.</p>
<p>Personal data is any information that relates to an identifiable individual. In this context, you are identifiable. Since you initiated the transaction, information about transaction relates to you. Information about the recipient of the transaction could then also be your personal data.</p>
<p>There are exceptions to your right to access your personal data. In particular, you may be refused access if it would adversely affect the rights and freedoms of others (Art 15(4) GDPR). Here, we must consider the rights of the recipient, who is also a data subject of the transaction information.</p>
<p>So in general, GDPR does arguably requires these money transfer companies provide you information about your transactions. Even if the right to access wouldn't apply, they might have a legitimate interest in providing you this information, in which case the GDPR wouldn't prohibit this.</p>
<p>But you must consider whether the information you seek is in scope of the transaction. You're seeking information about the bank account number of the recipient. Yet, PayPal and Western Union do not transfer money between bank accounts. Indeed, one of the reasons to use such services is for privacy, in order to minimize which information is disclosed to the other party. Another reason is that neither PayPal nor Western Union require the recipient to have a linked bank account.</p>
<p>So you're seeking information that is out of scope for the transaction itself. Such additional information cannot be argued to be your personal data. Disclosing this information to you would breach the recipient's privacy, if that information even exists. In some reason, there might be a legitimate interest to get this data, for example if you were defrauded and need to obtain the recipient's identity in order to sue them. However, the money transfer service will have to weigh the interests of the involved people (including the service's own interests) and will likely decline such a request. But they will likely disclose necessary data when instructed so by a court order.</p>

gdpr payment