We discovered an email sent from one employee to another "loaning" the second employee the use of their PCARD. Email contained their PAN and expiration date. There is no payment application associated with this, just one employee allowing another to use their P-Card to purchase something. This is a violation of our company policy, but does this place us a risk for PCI non-compliance?
From your question it seems the employee was emailing their own card data to someone? That should not be a PCI problem, because the company didn't mishandle card data controlled by the company. I'd say that they should be given a stern talking to because it might show poor judgment, and maybe have a record of that talk, but I don't think it will be an issue for you.
They cloudy bit in this might be, what did the receiver of the email do with the card data? There might be someone who could make a case that it then becomes company controlled data. Was that card EVER used to do a legit transaction with the company as a customer?
Similarly, if a person choses to send all of their own health data to someone, that wouldn't be a hipaa violation either, because that law similarly restricts data being handled by the organization, not by the person who's data it is.