We discovered an email sent from one employee to another "loaning" the second employee the use of their PCARD. Email contained their PAN and expiration date. There is no payment application associated with this, just one employee allowing another to use their P-Card to purchase something. This is a violation of our company policy, but does this place us a risk for PCI non-compliance?

  • 1
    At the very least, it looks like a couple of people should get a talking to by both their managers and HR. – mdpc Jul 20 '16 at 1:23
  • 1
    PCI compliance is for card processors, not consumers. So, unless this is part of your company's workflow, PCI is not applicable. This may be in violation of the cardholder agreement though. – Neil Smithline Jul 20 '16 at 1:50
  • In addition to what MDPC said I would suggest an Information Security Awareness training to be scheduled for employees and mandatory attendance for these two folks where Information Security and relevant company Policies along with best practices for maintaining your own security would be highlighted. – GhostSpeaks101 Jul 22 '16 at 11:06

From your question it seems the employee was emailing their own card data to someone? That should not be a PCI problem, because the company didn't mishandle card data controlled by the company. I'd say that they should be given a stern talking to because it might show poor judgment, and maybe have a record of that talk, but I don't think it will be an issue for you.

They cloudy bit in this might be, what did the receiver of the email do with the card data? There might be someone who could make a case that it then becomes company controlled data. Was that card EVER used to do a legit transaction with the company as a customer?

Similarly, if a person choses to send all of their own health data to someone, that wouldn't be a hipaa violation either, because that law similarly restricts data being handled by the organization, not by the person who's data it is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.