Politely, I think you're wrong on the DPA bit. This isn't personal information; it's not his card balance, his address, date of birth, or anything else that could be classed as personal in that sense; it's specific information about a commercial transaction which has already been offered...