It's persistent enough to be retrieved. There's no reason to keep that stuffany personally identifiable data unencrypted. If you can access it without a key so can an intruder.
Make it secure, and it will be compliant. Don't try and make it compliant by adding security later.
Being compliant (by passing your ROC) doesn't mean much to be honest. Companies that perform that activity are of varying skill, and often are selected based on the subject companies likelihood to get a pass. That is not how you protect your companies brand.
If you want ammo for the highers up, what about Massachusetts privacy law? How are you complying with your data requirements there? What about the EU http://en.wikipedia.org/wiki/Data_Protection_Directive and the third party transfer clause?
Encrypt PII/PAN data whenever it's sitting, setup appropriate key management, and use proven crypto-systems to do it. Be smart about protecting your customers data and your companies brand image and you will be compliant.