PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
asked Sep 11, 2012 at 9:30
-
Under what jurisdiction and circumstances?– PolynomialSep 11, 2012 at 9:32
Add a comment
|
3 Answers
First, IANAL. Secondly, this is entirely dependant on your local laws and regulations.
PCI-DSS is a guideline, but adherence to the guideline may be a requirement as part of certain laws. I'm not aware of any countries that do this, but in such a case you could be prosecuted if you violate a law that makes PCI-DSS adherence mandatory.
The more common case is not prosecution, but rather a civil suit. PCI-DSS is commonly a requirement as part of a contract between a merchant and a payment provider or bank, as part of their payment processing services contract. Violation of PCI-DSS results in a breach of contract, which allows them to sue you. Penalties and other terms are usually stated in such contracts.
answered Sep 11, 2012 at 9:39
-
4More specifically, compliance with PCI-DSS is part of the contractual agreement between merchants and members of the PCI industry group, of which not all credit card issuers are members of. Sep 11, 2012 at 12:08
-
1I worked with Visa for several years and with many large merchants. There is much FUD around PCI but it is really just part of an agreement between the card issuers and merchants. Suffice to say, read up on the biggest breaches with TGX and many other merchants that had demonstrated compliance failures. No one went to jail and moreover, the card issuers did NOT even pull their agreements with the merchants or sue them in civil court. After all, the merchants are the customers of the card issuers. May 6, 2016 at 17:17
-
@DarrellTeague I've worked with large financial clients who have been found non-compliant by their bank / payment provider. While I've never actually seen anyone sued or had their payment processing pulled, I have seen financial penalties be levied against non-compliant vendors, and another organisation be threatened with having their payment processing revoked for being hideously non-compliant for three years running. That last situation resulted in a massive departmental shakeup and at least one firing. May 6, 2016 at 18:03
-
Possibly though I suspect this is a grossly rare case (know of many big companies that have failed PCI audits or have border-line violations and Visa/MC do not pull their merchant agreements). To the original OP posting... being that PCI is not law and no one is going to jail for violation specifically thereof. Consider the Target breach. They were PCI-compliant yet were eventually sued in a class-action lawsuit by a group of banks. PCI had nothing to do with it one way or the other and in many cases fines are a cost of doing business. May 6, 2016 at 20:25
You can't be charged with not complying with PCI DSS, it's not a law. You can be charged with crimes like negligence if it is determined that you willfully ignored your duty of care, and not following PCI rules could be one instance of that. It's unlikely that would happen though, more likely you or your company would get sued for monetary damages, and not following PCI would be one of the pieces of evidence used to show culpability.
-
AFAIK "negligence" isn't a crime except in limited situations involving death or injury to persons. For legal advice consult a licensed attorney. Dec 30, 2013 at 6:11
Compliance with PCI DSS is required by law in Nevada (Nev. Rev. Stat. Ch. 603A) and Washington (Wash. H.B. 1149 (2010).
-
NRS 603A.900 provides only civil remedies for a breach, yet NRS 603A.910 provides that a court may order a party who is "convicted of unlawfully obtaining or benefiting from personal information" to pay restitution. These sections appear to contradict one another, unless there's another Nevada statute making a breach of Ch. 603A a crime. Dec 30, 2013 at 5:58