Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

PCI DSS isn't a law. Why can I be prosecuted for not being compliant?

share|improve this question
    
Under what jurisdiction and circumstances? – Polynomial Sep 11 '12 at 9:32
up vote 18 down vote accepted

First, IANAL. Secondly, this is entirely dependant on your local laws and regulations.

PCI-DSS is a guideline, but adherence to the guideline may be a requirement as part of certain laws. I'm not aware of any countries that do this, but in such a case you could be prosecuted if you violate a law that makes PCI-DSS adherence mandatory.

The more common case is not prosecution, but rather a civil suit. PCI-DSS is commonly a requirement as part of a contract between a merchant and a payment provider or bank, as part of their payment processing services contract. Violation of PCI-DSS results in a breach of contract, which allows them to sue you. Penalties and other terms are usually stated in such contracts.

share|improve this answer
3  
More specifically, compliance with PCI-DSS is part of the contractual agreement between merchants and members of the PCI industry group, of which not all credit card issuers are members of. – Scott Pack Sep 11 '12 at 12:08
    
+1 for your second paragraph. – Kyle Rozendo Sep 11 '12 at 19:58
    
I worked with Visa for several years and with many large merchants. There is much FUD around PCI but it is really just part of an agreement between the card issuers and merchants. Suffice to say, read up on the biggest breaches with TGX and many other merchants that had demonstrated compliance failures. No one went to jail and moreover, the card issuers did NOT even pull their agreements with the merchants or sue them in civil court. After all, the merchants are the customers of the card issuers. – Darrell Teague 7 hours ago
    
@DarrellTeague I've worked with large financial clients who have been found non-compliant by their bank / payment provider. While I've never actually seen anyone sued or had their payment processing pulled, I have seen financial penalties be levied against non-compliant vendors, and another organisation be threatened with having their payment processing revoked for being hideously non-compliant for three years running. That last situation resulted in a massive departmental shakeup and at least one firing. – Polynomial 6 hours ago
    
Possibly though I suspect this is a grossly rare case (know of many big companies that have failed PCI audits or have border-line violations and Visa/MC do not pull their merchant agreements). To the original OP posting... being that PCI is not law and no one is going to jail for violation specifically thereof. Consider the Target breach. They were PCI-compliant yet were eventually sued in a class-action lawsuit by a group of banks. PCI had nothing to do with it one way or the other and in many cases fines are a cost of doing business. – Darrell Teague 4 hours ago

You can't be charged with not complying with PCI DSS, it's not a law. You can be charged with crimes like negligence if it is determined that you willfully ignored your duty of care, and not following PCI rules could be one instance of that. It's unlikely that would happen though, more likely you or your company would get sued for monetary damages, and not following PCI would be one of the pieces of evidence used to show culpability.

share|improve this answer
    
AFAIK "negligence" isn't a crime except in limited situations involving death or injury to persons. For legal advice consult a licensed attorney. – user35648 Dec 30 '13 at 6:11

Compliance with PCI DSS is required by law in Nevada (Nev. Rev. Stat. Ch. 603A) and Washington (Wash. H.B. 1149 (2010).

share|improve this answer
    
NRS 603A.900 provides only civil remedies for a breach, yet NRS 603A.910 provides that a court may order a party who is "convicted of unlawfully obtaining or benefiting from personal information" to pay restitution. These sections appear to contradict one another, unless there's another Nevada statute making a breach of Ch. 603A a crime. – user35648 Dec 30 '13 at 5:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.