Payment in these cases will often be via a credit card transaction. Principle 4 again requires us to take reasonable steps, and Principle 3 of the Ordinance says that data must be used only for the original purpose of collection something that a third party is unlikely to adhere to. This is a commercial matter rather than one relating to privacy. The seller never sees the decoded credit card details, so even messages on the merchant's computer do not compromise this important personal data. The right approach to collecting payment depends on the frequency, nature and average size of transactions.
Encryption is discussed below.
The Ordinance is not just about security. It is relevant to EC in other areas as well. For example, forms submitted by customers from a web page should comply with Principle 1 of the Ordinance they should state the purpose for which the data will be used and ask only for data required for that purpose. The purpose should be lawful and directly related to a function or activity of the data user. If the organisation may transfer the personal data to another data user, then the classes of such data users should be listed.