Customers who reserve a table and then don’t showing up or cancel their booking at the last minute are a real problem for restaurateurs on many levels. In order to avoid this, many of them are in favour of the bank imprint at the time of reservation. The customer provides their contact details and credit card details by phone or via internet and if the reservation is not honoured, they are debited accordingly.

Compliance with the law, the GDPR, the level of penalties imposed, data retention, potential disputes with the restaurant owner... many questions still surround the poorly regulated practice.

What is a bank fingerprint?

The Luxembourg Consumers' Union (ULC) and the European Consumer Centre (ECC) in Luxembourg say they have never been confronted with this question and therefore do not have a precise definition. For Aline Rosenbaum, a lawyer at the ULC, it cannot be considered as a deposit or a down payment.

A deposit is a sum paid in advance when purchasing a service. Unless provided for in the contract, the trader keeps this sum, even if the purchase is not ultimately made. The advance payment creates an obligation to fulfil the commitment on both sides. The trader must supply the goods or service and the consumer must buy it, unless otherwise agreed. And if he withdraws, he will often have to pay damages.

If no debit is made before the meal, but only afterwards, in the event of cancellation, "the money would then be taken as compensation for cancellation", continues Rosenbaum.

Capital describes the bank imprint as a guarantee that the customer has enough money to pay.

The Clairefontaine restaurant, which asks for a bank imprint 'on a case-by-case basis', explains: “We send a link to the customer. It is they who enter their card details with everything that is requested. They don't pay anything in advance. In the event of a 'no show', we activate the button so that they are debited with the expected amount. This corresponds to the price of the menu, €100 in the evening, and €59 at lunchtime.” But "we have never had to do this”, the restaurant adds. 

Can a restaurant, or even a hotel or a doctor, request this information?

Whether it is an advance, deposit, down payment or termination fee, "there is no prohibition for a trader to do this,” says Rosenbaum. "I am not aware of any specific provision that would limit this to certain sectors." In any case, "the consumer should have been informed in advance by the restaurant owner of the principle and the amount of the compensation".

Nor is there any ceiling on compensation set by the law, even though a deposit, "by definition, corresponds to only part of the total price". In the event of a dispute, it would be up to a judge to decide whether an amount could be considered exaggerated or not. The compensation "should not manifestly exceed the actual damage suffered by the restaurateur".

"In law, if it is not forbidden, it is authorised,” confirms Julie Jasson, a lawyer at the CEC. But the judge remains the guardian of "unfair or unclear" measures. During an internet transaction, it is after all good practice to be aware of the trader's general conditions.

Can a trader ask for this information by telephone?

In principle, there is no rule here either. A contract "can be concluded orally". In this case, Jasson advises the customer to "ask what use will be made" of the data. She adds that there is "always a risk. You don't know who you're talking to, whether the person really works for the restaurant or whether it could be an employee acting in bad faith who could use it for something else. Even by email, someone can look at the computer and steal data."

One should "check one's accounts regularly and contact one's bank in case of suspicious withdrawals". According to her, if the practice spreads, it could be "regulated in the future".

What about data retention?

"This is a collection of personal data," says Vincent Wellens, a lawyer at NautaDutilh who specialises in data protection. "This is the application of the General Data Protection Regulation (GDPR)." The customer must "be duly informed of how and for what purpose their data is being processed,” he adds.

In the context of a restaurant, where they aim to avoid a "no show", "from the moment the customer arrives [for the booking], their data must be deleted. If they don't show, they should only be kept until the dispute is resolved,” he explains.

In the event of a debit for an amount higher than the one defined, or in another context, the consumer can in any case claim his or her reimbursement, says Rosenbaum.

What protection for bank data?

"In general, for any e-commerce payment, three steps are necessary. This is called strong customer authentication," says Judith Gledhill, COO of the Association of Banks and Bankers, Luxembourg (ABBL). It requires "the cardholder's number and name, the cryptogram and confirmation either by PIN code or by a Luxtrust authentication method. If one of the three elements is missing, then, in general, no payment can be debited."

However, this is not always the case. "The only secure way of communicating full bank details is to do so as part of a secure online payment, using the 3D Secure system," adds Rosenbaum.

If the establishment goes bankrupt, is the consumer reimbursed?

"The consumer would then have a claim against the restaurateur, which would be considered like any other unsecured claim. There would therefore be a great risk that it would not be recovered," says the lawyer.

What if the customer falls ill and cannot come?

"It all depends on the agreement reached" between the parties, the lawyer believes.

This article was first published in and has been translated by Delano.