[w3c/payment-request] Proposed privacy consideration regarding data usage (#868)

At the 29 May teleconference [1] we discussed the usage of data from PR API for account creation. I am hearing a variety of perspectives and I am starting to think we should make a statement in the specification, for example in the security and privacy considerations. For example, something like an informative note:

Title: Data usage

Payment method owners establish the policies for how user data collected for the payment method may be used. Payment Request API sets a clear expectation that data will be used for the purposes of completing a transaction, and user experiences associated with this API convey that intention. It is the responsibility of the payee to ensure that any data usage conforms to payment method policies. For any permitted usage beyond completion of the transaction, the payee should clearly communicate that usage to the user.

[1] https://www.w3.org/2019/05/30-wpwg-minutes#item02

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/issues/868