Well, there are different questions here.
First is: is it legitimate to ask for the card number, CVV and expiration date to setup recurring payments?
My opinion is: yes it is. The third party does not know you and requires some guarantees that your card is valid. And your bank will ask them to prove that you actually give them all those informations. So those informatiosn should not be stored in their information system but are nevertheless required.
Second is which protocol should I use to send them that?
The most secure and less convenient is of course to physically deliver that in person. No third party will ever see it.
Second IMO is the fax. It could be intercepted, but it is now a uncommon attack vector
Last is of course the email because it will be accessible to your mail server operator.
IMHO it is still acceptable. These are of course personal and sensitive informations, but not secret informations. You bank knows them. The different sites where you have bought something know them. They should not have stored that but can you make sure of it? Simply you should:
- immediately remove the mail from the sent folder
- control the operations on your bank account for a while and immediately warn the bank if one is suspect
- control the contract with your bank. Commonly, you are only responsable if you are not cautious enough. Sending a mail to a well known organization and removing all traces you can access should be acceptable. In doubt contact the bank.
Third what can be done to make sure no unnecessary copies will persist?
My answer it nothing, or just pray. Once you deliver them the information it is out of your control. If you do not trust them, do not give them. You can ask them to eat or burn the paper, but I would not be confident that they obey... And even if the person you ask to not store the information say that they will not, you will never be able to control it, just like when you use a HTTPS form.