There is a local mom and pop video store that requires new customers to write their names, addresses, and credit card information on 3x5 cards. These cards are actually kept in a recipe cards box that is left sitting on the counter, often times unattended. They also have shoe boxes left in plain site that are full of older cards for infrequent or non-returning customers. Several times I've witnessed these cards scattered across the counter as they use them to attach to movies that are being reserved. In this day of credit card fraud and theft, I'm dumbfounded that this is happening. Is this legal? Doesn't this violate credit cards companies policies of safe credit card storage? Also, is there a way to report this? Customers have complained but they just say that's how they've done it for 30+ years. They have no computer system at all in place to switch over and don't plan on getting one.
IANAQSA, and this is outside my personal experience, but here goes:
In this day of credit card fraud and theft, I'm dumbfounded that this is happening. Is this legal?
Legal? Depends on where you are, but... probably, yes. Note that even in the TJX breach, where 45 Million cards were compromised, the legal charges against them were for PII, not for violation of card numbers. There's generally no laws about that, only Card Brand requirements.
Doesn't this violate credit cards companies policies of safe credit card storage?
Yes, this violates the PCI DSS 9.5:
Now, the DSS is generally only thought of for business with computers and networks. Since IANAQSA, I can't speak to whether the business you describe would be expected to hew to it. That being said, I've no doubt that whatever contractual language they sign in order to be allowed to process cards invokes similar cautions because, as you state, they're pretty basic.
Also, is there a way to report this?
You can report it to their processor, if you can determine who that is, and that may or may not have any effect. You can also complain to the card brands (form for Visa, form for Mastercard) and there's still no guarantee that'll have any effect.
You can also vote with your feet. Ask them to destroy your card, watch them do it, and don't go back there again.