What has PayPal done about GDPR?

An artist asked me a question about PayPal and GDPR this morning.
The nub of it is as follows...

• she sells art through her website - and accepts PayPal for payments
• she checked on her account and the past history (from way back) still includes past customers' names, addresses and email addresses. Plus their payment method may or may not have stored by PayPal.

It immediately struck me that this is a question that a lot of artists are going to be asking given the way PayPal is now entrenched as a form of payment for art being marketed and sold online.

​ What she wants to know is 

1. what has PayPal done about GDPR?; 
2. whose responsibility is it to keep this personal data safe?
3. how should she tell customers about whether or not they are compliant if she doesn't know!)?  
4. who is responsible re. data protection if somebody hacks into her Paypal account which carries all this data?

What has PayPal done about GDPR?
​

This is a really good question! Also one which it appears LOTS of people would like answers to.

• If you insert GDPR into their Help System it comes up with precisely zilch!
• If you put PayPal and GDPR into Google you don't get a lot of help.
• However there is one PayPal Stories Article called Getting GDPR Ready (relevant to those in the UK - I'm guessing everbody gets their country equivalent if they look online). Interestingly it says NOTHING about what PayPal will be doing in terms of processing your customer's personal data!

I  was told that PayPal has updated its legal agreements. See PayPal's Policy Updates page for the upcoming changes.

These include:

• Notice of amendment to the PayPal User Agreement. Effective Date: May 25, 2018 (i.e. GDPR Implementation date) - this includes changes relevant to the 1. Control and protection of personal data
• Notice of amendment to the PayPal Privacy Policy Effective Date: May 25, 2018 - find the amended PayPal Privacy Policy by clicking here

Whose responsibility is it to keep this data safe?
​

I don't think Paypal has any option - in processing personal data for EU residents it must by default comply with GDPR and all its requirements

All uses of PayPal accounts are also responsible for using appropriate means for keep access to the account limited to those who should have access eg using two levels of protection - password and a code sent to your phone.

Anybody else got any thoughts on this - or seen anything relevant?

How should she tell customers about whether or not PayPal are compliant (if she doesn't know!)
​

I guess we have less than 60 days to find out the answers!

I have no doubt there will be answers - it's very evident from the policy changes so far that GDPR applies to them. The question is how many more changes are they likely to make.

Who is responsible re. data protection if somebody hacks into her Paypal account?
​

Both are - for their respective "ways in" to the system.

Comments are very welcome on this topic as are links to helpful articles or webpages on this topic. I'll add them into the DPDR Resource Page if we get a lot.