Out-Law News 1 min. read
Dutch courts rule that payment providers can be compelled to supply data
27 Mar 2025, 10:54 am
A recent decision by a Dutch court has confirmed that payment and intermediary service providers can be compelled to surrender customer data, according to an expert.
In the case, Stripe, a payment provider, denied a data access request from a disgruntled customer who made a purchase from a Shopify-based web shop.
Stripe, which stated they it directly provided the consumer’s data to the web shop operator and only collected the shop operator’s identification details to comply with applicable anti-money laundry regulations, argued it could not hand over the data because it could not be used for any other purposes.
The court denied the customer’s data access claim under article 15 of the General Data Protection Regulation (GDPR), which gives individuals the right to request a copy of any of their personal data or relevant information that is being processed by ‘controllers’, because it was unclear if Stripe or Shopify had forwarded the customer’s data to the operator during the purchase. Nevertheless, the court did award the customer’s claim to get access to the operator’s details that Stripe had on file on another legal basis.
Wouter Seinen, an expert in technology and privacy data at Pinsent Masons, said: “On its legal merits this judgment is not novel, but the case does confirm that even intermediary service providers, including payment service providers (PSPs), can be compelled to surrender customer data to private claimants.”
“The Dutch courts are willing to consider such requests and deal with them in injunction proceedings,” he said.
“In fact, this pragmatism serves both the claimants and the PSPs: the claimant has a possibility to get the data at hand within a short time frame and, if the court orders the production of the data, the PSP no longer carries the GDPR and FinReg compliance risks as it can rely on its duty to comply with a court order.”
The court dismissed arguments that the details that the operator’s details were exclusively retained for anti-money laundering compliance because Stripe also had a contract in place with the operator, resulting in the court ordering Stripe to produce the requested data for the customer.
Contact an adviser
