Maestro Global Rules (PDF) - MasterCard

3.22 Data Protection
Europe Region
3.22 Data Protection
In addition to the defined terms in the “Definitions” chapter in part 1 of this
rulebook, the following apply solely to Rule 3.22:
3.22.1 Definitions
Solely for the purposes of this Rule 3.22,
1. “Controller” shall mean the entity which alone or jointly with others
determines the purposes and the means of the Processing of Personal Data.
2. “Data Subject” shall mean a Cardholder, or Merchant, or other natural
or legal person (to the extent a legal person is subject to national data
protection law) who’s Personal Data are processed by a Customer in the
EEA or Switzerland and the Corporation.
3. “EU Privacy Directive” shall mean, collectively, the Directive 95/46/EC of
the European Parliament and of the Council of 24 October 1995 on the
protection of individuals with regard to the processing of Personal Data
and on the free movement of such data and Directive 2002/58/EC of the
European Parliament and the Council of 12 July 2002 concerning the
processing of personal data and the protection of privacy in the electronic
communications sector, as may be amended from time to time.
4. “Personal Data” shall mean any information relating to an identified or
identifiable natural person; an identifiable natural person is one who
can be identified, directly or indirectly, in particular, by reference to an
identification number or to one or more factors specific to his or her
physical, physiological, mental, economic, cultural, or social identity.
5. “Processor” shall mean the entity which processes Personal Data on behalf
of a Controller.
6. “Processing of Personal Data” shall mean any operation or set of operations
which is performed upon Personal Data, whether or not by automatic
means, such as collection, recording, Corporation, storage, adaptation
or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination, or otherwise making available, alignment or combination,
blocking, erasure or destruction of such data.
7. “Transaction-related Personal Data” shall mean the Personal Data required
for authorizing, recording, settling and clearing a Transaction processed
by the Interchange System.
©1993–2012 MasterCard. Proprietary. All rights reserved.
Maestro Global Rules • 9 November 2012 17-13