3

I am developing a service, a part of which stores the credit card data of it's users. According to the Israeli credit card companies' requirements my users need to present their government ID number when making a transaction.

The PCI Standard prohibits the storage of CVV and credit card PIN numbers, because of information security reasons.

My question is, can I be sure that storing my users' government ID numbers is not against the PCI standard, since it serves almost the same purpose as a CVV or a PIN number - to verify the credit card holder?

Improve this question

1 Answer 1

Reset to default
2

PCIDSS publishes how you store payment card data. A government Id is not covered.

However it probably is personally identifiable information and should still be handled with care.

The full set of requirements is buried in a pdf

https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dss

But basically you have to encrypt the card number, and you cannot retain the CVV2 / PIN or any of the data you might read from a card (but that you can't see by looking at it)

Everything else is allowed to be stored unencrypted.

Improve this answer
3
  • 2
    This is all true. However, there might also be Israeli law which covers storing government ID#s. It wouldn't be part of PCIDSS, but it would be applicable if operating in Israel.
    – Bobson
    Jan 21, 2017 at 23:48
  • Yes, you need to check the local Israeli laws on this matter, I can't read the Hebrew law text but there is an English news article about them locking down the ID number and not using it for this very purpose after a high profile attack in 2012: timesofisrael.com/…
    – ewanm89
    Jan 22, 2017 at 12:48
  • Thank you guys, I'll check the laws and requirements of my country and the credit card companies to see if they say something about it.
    – Theodore
    Jan 24, 2017 at 6:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .