It looks like the GECD request is happening without the user having actually signed in to PayPal and clicked the button to continue back to your site. We see PaymentActionNotInitiated, and that's the only way I can think that GECD would be returning a response without that info...if you just called SEC and then passed that token into GECD right away without redirecting to PayPal first.

You need to call SEC, redirect to PayPal so the user can login, and then call GECD from your return URL. One way or another that seems to be getting skipped..??