It used to be that you could take a new loyalty card at grocery stores, use it right away, and never register it. So you have an anonymous account and you still got discounts. I wondered if loyalty programs survived the emergence of the GDPR for that reason. But in fact the anonymous option seems to be dead.

  • Delhaize is the sneakiest and least tolerant. You can use an unregistered card all you want for countless months with no indication of rejection. Card is accepted silently and receipts show the card was used. I thought I was racking up discounts and points or something. Then one day I tried to exploit a promo that should have instantly had effect at the register. The register again accepted the card but silently charged the full amount. This time I was paying attention and complained. Delhaize told me my card is basically an impotent placebo because it’s not registered to a name and address. The cashiers are not flexible either. At some grocery stores cashiers will pull out their personal card and do you a favor but not Delhaize.

  • Intermarché loyalty cards are also impotent unless you register them.

  • Colruyt has a pushover loyalty program, which is good for us. If you don’t have a card they scan a code that is taped to the register. But you have to pay attention and ask for the promo.

Under the GDPR, the loyalty programs work under the legal basis of “legitimate interest” (not contract, which is what you might otherwise expect). That enables them to legally collect data but it does not exempt them from data minimisation. This seems to suggest Delhaize and Intermarché are non-compliant when the force disclosure of birthdate and address. Otherwise I do not see how they are GDPR compliant.

Colruyt is still doing something dodgy with prices. They have the electronic price tags so they can electronically instantly update prices. The shelf prices are not in sync with the cash register… wtf? You would only expect pricing to be out of sync if the prices were printed on paper. So pay attention to the price on the shelf. I saw something ring up ~25% more. On another visit that same item range up for ~6% more.

  • ciferecaNinjo@fedia.ioOPM
    link
    fedilink
    arrow-up
    1
    ·
    9 days ago

    The “working party 29” produced detailed guidance on the legitimate interest legal basis (wp217) which likely answers this. I’ll have to read that again. Someone in a forum said age collection would violate the data minimisation principle, but they may not have considered the point you make.