By Ross Federgreen, Ken Musante and Theodore Svoronos
The Payment Card Industry (PCI) Data Security Standard (DSS) falls under the broader topic of personally identifiable information (PII). The theft of PII is commonly known as identity theft.
Identity theft issues are broad and far reaching; they are consuming greater corporate resources, both nationally and internationally. The consequences of handling PII in a manner inconsistent with prevailing laws can be severe, regardless of whether the noncompliance was due to accident, incompetence, compromised internal staff or lack of knowledge regarding applicable regulations.
Fraud resulting from identity theft is now a $50 billion-per-year crime, and growing. According to the Federal Trade Commission, it is the most common complaint the agency receives from consumers.
In 2006, the Identity Theft Data Clearinghouse, a national database established to assist law enforcement investigations, received 674,354 complaints forwarded by the FTC, the Internet Crime and Complaint Center and other organizations; 246,035 of those (36 percent) pertained to identity theft.
Each year the number of agencies involved and laws enacted regarding PII at federal and state levels increases. Also, many laws in effect in international venues parallel or exceed rules in place in the United States. Rules and regulations governing PCI are implemented country by country.
PII covers a growing list of data elements that can be tied to or represent a given individual. Illegal or negligent use of these elements can cause individuals to be harmed. PII includes:
PII is often used to open bank accounts as well as merchant accounts. In most instances, a combination of data elements is required for a compromise to occur.
Many of the items listed under the umbrella of PII are regulated both by civil and criminal laws; they carry penalties on federal and state levels. As of this writing, 48 states regulate the use, storage, transmission and disposal of various elements of PII - including credit card information. The federal government has adopted, or is considering, a number of rules and regulations regarding actions associated with PII. The most specific edict to date is the 2008 FTC consent decree released in the Life Is Good Inc. case.
The FTC charged that LIG "failed to provide reasonable and appropriate security for the sensitive consumer information stored on its network," even though the company stated on its Web site that such information "is kept in a secure file."
The consent decree is broad. In nine specific orders, it covers all aspects of LIG's data protection policies, procedures and ethics. One order requires the company to obtain an independent, third-party auditor to review and assess its security measures every other year for the next 20 years.
Already, at least 13 federal laws and regulations either directly or tangentially affect PII. Some examples are the:
And during the 110th U.S. Congress, Senate committees favorably reported out three data security bills that include information security and data breach notification requirements. Other data security bills were also introduced in the House of Representatives and the Senate.
The PCI DSS, the Payment Application DSS and the PCI PIN Entry Device Standard are designed to protect primary account numbers and their related sensitive data - in other words, credit and debit card numbers - from illegal or unauthorized use.
These industry best-practice-driven recommendations and mandates are closely tied to the current, pending and proposed directives of various federal and state entities. In fact, many distinct principals of these rules and regulations can be traced back to historical legislation in this field.
As in all situations, state and federal laws and regulations trump regulations and mandates of the PCI Security Standards Council. And in the absence of a comprehensive federal data breach notification law, many states have enacted laws mandating consumer notification regarding security breaches of personal data.
As of January 2008, 39 states had enacted data security laws requiring entities to notify persons affected by security breaches and, in some cases, to implement information security programs to protect the security, confidentiality and integrity of data. One example is the California Financial Privacy Information Act, which dictates that, in the event of a breach, the impacted company must publicly disclose said breach.
Additionally, six states (California, Connecticut, Illinois, Massachusetts, Minnesota, and Texas) have introduced bills designed to strengthen merchant security and hold companies liable for third-party companies' costs arising from data breaches.
As a result, public disclosures have heightened interest in the following:
What does it all mean for you, as ISOs and merchant level salespeople? Failure to ensure your merchants are PCI compliant will open you up to greater and greater liability from multiple sources, both civil and criminal.
Ross Federgreen is founder of CSRSI, The Payment Advisors, a leading electronic payment consultancy specifically focused on the merchant. He can be reached at 866-462-7774, ext. 1, or rfedergreen@csrsi.com.
Ken Musante is President of Humboldt Merchant Services. Contact him by e-mail at kmusante@hbms.com or by phone at 707-269-3200.
Theodore Svoronos, Payments Consultant for Irvine, Calif.-based Group ISO, can be reached by phone at 800-960-0135 or by e-mail at ted@groupiso.com.
The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.
Prev Next
