Data Protection versus Record Retention

PCI-DSS | Telephone

Like the so-called right to be forgotten, requirements of the Payment Card Industry Data Security Standard (the PCI) can clash with record retention needs.  The PCI sets industry standards for credit card merchants to secure card data.

A student in my SANS legal course related the following story.  PCI Section 3.2.2 states:  “Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions.”  His company, a credit card merchant, takes card payments over the
telephone in live voice transactions between customers and the company’s representatives.  For each transaction, the company audio records the entire voice exchange.  Naturally, the company takes from the customer the card verification code covered by PCI 3.2.2.  As the customer vocalizes that code, the company makes an audio recording of the code.

The company noted that to record the code is a violation of the literal words of PCI 3.2.2.  However, the company also noted that legal and business imperatives call for it to retain the full audio record.  That record is needed in the event of a dispute with a customer.  A customer might try to repudiate a transaction, claiming it never happened.  Without the record, the company would lack strong evidence that the customer entered the transaction.  

Further, that audio record protects the company from other problems such as internal fraud by employees and allegations of tax evasion.  (Example: A tax authority might investigate whether the company understated its profit, assets or revenue by mis-recording the value of its rights, assets or accounts receivable applicable to credit card transactions, including recurring and contingent transactions.  Those audio records help the company prove that it properly accounted for transactions.)

Therefore, with the advice of counsel, the company decided it would store the card verification codes in audio records contrary to PCI 3.2.2.  The company would also take alternative measures to protect the data on those records from misuse or wrongful disclosure.

Dear reader: What do you think about this story?

-–Benjamin Wright, Practicing Attorney and SANS Institute Instructor on the Law of Data Security and Investigations (including e-records and e-discovery)

Comments

[Larry]

Interesting, but shouldn't they as MEMBERS of the Industry who issued the Standard be reporting TO THE INDUSTRY there is an inconsistency between required business needs and practices stated in the language contained in the Standard?

Standards are only as good as they are applicable. If language needs to be modified or added to meet business needs, such as "Store card verification code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions utilizing secure, limited access means.”, then it should be suggested to the PCI. Subsequently, examples should be provided of what those 'means' would include.

[Benjaminwright]

Larry: Thank you for your comment. I do not believe that the tradeoff between data protection and record retention is well understood. I have seen very little discussion of it in the context of PCI or data security guidelines, such as the "right to be forgotten" coming out of EU. One reason I published this story is to help all of us learn to balance the need for destroying sensitive data, on the one hand, against the need to preserve records for legal and other purposes, on the other. --Ben

[Larry]

Ben your point is understood and its possible the distinction is NOT well understood, but isn't it imperative that the body issuing Standards for the Industry be made aware of this distinction?

Writing Standards that are going to be ignored by the Industry they impact is counter productive, and if it happens because they don't understand how their work practices... the two should talk!

[Albatross]

I worked for a major retailer a few years ago who proudly upgraded all the security cameras in their retail stores with new, high-quality versions. Shortly thereafter it was discovered that the cameras had sufficient zoom and clarity to clearly record the front and back of a credit card as a customer made a payment.

Faced with having to add their video security system to the PCI security domain, the retailer dispatched contractors to install limiting brackets on their brand-new, high quality cameras, to prevent their being able to zoom in sufficiently close to capture the credit card image.