Can my address as well as final 4 digits and name on credit card be stored without PCI compliance?

Question

So, if you stupidly sign up to a site using a credit card and then come to regret it and worry that said site is vulnerable to hacking what data can they legally hold without needing to be PCI compliant.

Things I know are:

1. They use a PCI compliant payment gateway.
2. There own server is in a secure facility.
3. They claim to store only the final 4 digits of the credit card and only so that customers can quickly put more money on their account quickly without the need for entering full cc details every time.

Do you think this is all they hold? Would they also hold name and address to be able to carry out that transaction?

Sorry if I haven't been clear. This is what I received from the company when I asked if I could delete my personal data from their database:

Firstly, we are not allowed to store functional credit card data, so we don't. We do store the last four digits as on their own they are meaningless and help us authenticate you when using the quick re-purchase method. Secondly, our upstream payment provider is authorised to store your card data by VISA/MasterCard. As such they are audited annually and have to jump through all the hoops and conformity required by the PCI DSS standard. Thirdly, it is a requirement of any business to keep records of who they're dealing with. Your personal data is being stored so high up the chain that it must be kept. Other companies who claim to delete your data are most likely the first link in the chain or at an entry level. They delete it and probably shouldn't even be storing it, but their upstream provider is required to keep it.

They keep referring to this email when I ask for further clarification as to whether they themselves or only the payment gateway hold my name and address against that credit card and the account I set up with them. I have never given my address for delivery only for payments as it was a gambling website.

Answer 1

If an organisation receives, processes, or stores credit card data (even if this is only hosting a payment gateway iframe or form) then they are required to be PCI compliant. Note the 'or' here - any one or more of these means you are required to be compliant.

There are no exceptions to this.

They may be required to provide a lower level of compliance i.e. need fewer controls, but they will still have to assess their required level and implement the controls that the level requires.

Even if they only hold data 'in transit' for a short period of time and never store the card data to disk, they will need to be compliant.

Again, this isn't a judgement call - if you collect, store, or process any card data at all (even just 'in passing') you need to be compliant.

Of course, how many organisations are compliant is a whole other question. Enforcement has not been 100% in the past although this is changing.

Answer 2

It is very possible, and quite likely, that they do store- Name, Address, Phone number, email, and other contact and purchase data. This is irrelevant to PCI. PCI cares about the credit card data (CHD) and account number (PAN) and the other data on the mag stripe - including the "extra" numbers on the back of the card, and the expiration date.

PCI forbids storage of the mag stripe data and the "extra" numbers, (for anyone other than those who really need it).
PCI permits storage of the last 4 numbers along with other pieces of data such as a transaction number and for repeating transactions, the merchant can also store a special single-merchant number that looks like a credit card number and works the same, but it is tied to the merchant.

Most merchants do not want the wrath of the PCI council and/or their bank and/or law enforcement, and will do everything they can to "de-scope" systems out of PCI scope. So, there is the question if they are 100% compliant, however, they may be compliant "enough" with only the data you indicated.

Answer 3

PCI-DSS allows the storage of your cardholder data, credit card number, and expiration date as long as they are encrypted at rest and in transit.

Never store full contents of any track from the card’s magnetic stripe or chip (referred to as full track, track, track 1, track 2, or magnetic stripe data). If required for business purposes, the cardholder’s name, PAN, expiration date, and service code may be stored as long as they are protected in accordance with PCI DSS requirements.

It does not allow the storage of the verification code or PIN.

Never store the card-validation code or value (three- or four-digit number printed on the front or back of a payment card used to validate card-not-present transactions).

Never store the personal identification number (PIN) or PIN Block.

It could be that they store the full card number but only allow you to see the last four digits.

Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not apply to those authorized with a specific need to see the full PAN, nor does it supersede stricter requirements in place for displays of cardholder data such as on a point-of-sale receipt.

Link

Answer 4

So, if you stupidly sign up to a site using a credit card and then come to regret it and worry that said site is vulnerable to hacking what data can they legally hold without needing to be PCI compliant.

...

I have never given my address for delivery only for payments as it was a gambling website.

The issue that you're struggling with is not their PCI compliance, or even what you can try to compel them to do to stay within PCI compliance, but rather the fact that you used your card at a gambling site and now wish you hadn't.

Sorry if I haven't been clear. This is what I received from the company when I asked if I could delete my personal data from their database:

There is nothing in the PCI to compel them to delete your data and, as they've pointed out, their upstream processor - which has the full set of data and is in PCI scope - has a requirement to retain the transactional records, which include things like your card number and (if submitted) name.

To put it bluntly, you don't have any ownership of your transactional history. When you submit your name to purchase something, it becomes part of the transaction, and that transaction is owned by the processor. The processor must meet the requirements of the PCI DSS, of course, and must protect your names commensurate with applicable PII regulations...

(Note that even a stringent state like Massachusetts with 201 CMR 17.00 makes no mention of compelling the business to respond to PII deletion requests - PII law is about punishing loss/misuse, not preventing use).

You've asked them to delete your account; they've declined and - quite reasonably - pointed out that even if they did so, it wouldn't address your concerns. They are allowed to decline. You cannot compel them with the PCI.

You might be able to compel them with a lawyer, but that will cost you money.

If you're concerned about someone misusing the account, then report your credit card stolen and get a new one issued. That's really your only protection.