PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
First, IANAL. Secondly, this is entirely dependant on your local laws and regulations. PCI-DSS is a guideline, but adherence to the guideline may be a requirement as part of certain laws. I'm not aware of any countries that do this, but in such a case you could be prosecuted if you violate a law that makes PCI-DSS adherence mandatory. The more common case is not prosecution, but rather a civil suit. PCI-DSS is commonly a requirement as part of a contract between a merchant and a payment provider or bank, as part of their payment processing services contract. Violation of PCI-DSS results in a breach of contract, which allows them to sue you. Penalties and other terms are usually stated in such contracts. |
|||||||
|
|
Compliance with PCI DSS is required by law in Nevada (Nev. Rev. Stat. Ch. 603A) and Washington (Wash. H.B. 1149 (2010). |
|||
|
|
|
You can't be charged with not complying with PCI DSS, it's not a law. You can be charged with crimes like negligence if it is determined that you willfully ignored your duty of care, and not following PCI rules could be one instance of that. It's unlikely that would happen though, more likely you or your company would get sued for monetary damages, and not following PCI would be one of the pieces of evidence used to show culpability. |
||||
|
|
