The Legal Implications, Risks and Problems of the PCI Data Security Standard

While starting off as "just" an information security standard, the Payment Card Industry Data Security Standard, v. 1.1 ("PCI" or "PCI Standard") now presents serious legal challenges and risk for retailers. The PCI framework currently operates like a law without courts or regulators - there is no centralized body to resolve interpretative discrepancies in a consistent, precedental and binding manner. Moreover, in many cases PCI compliance is performed by security professionals with no attorney collaboration and little understanding of the legal risks involved. This article discusses the legal framework and implications PCI, the problems with the standard in the legal context, and actions that merchants should explore to reduce legal risk arising out of PCI.

PCI Background.

The PCI Standard is a grouping of six control objectives that a merchant, service provider or other entity subject to PCI must satisfy to secure cardholder data. The Standard has been universally adopted by the major payment card companies. However, each payment card company also has its own payment card security program ("Security Program"). The Security Programs are the definitional, procedural and enforcement rules and requirements of the payment card brands around payment card security. Examples include VISA's Cardholder Information Security Program (VISA CISP) and MasterCard's Site Data Protection. Security Programs dictate merchant level definitions, procedures, deadlines and documentation for validating PCI compliance, documentation requirements for security assessment, security incident response requirements and fines and penalties. So if a merchant deals with all the five major payment card brands, it must comply with not only the PCI Standard, but also each five separate Security Programs. All of this is enforced contractually.

The Legal Foundation of PCI - The PCI Contract Chain

Unlike security laws such as Gramm-Leach-Bliley, HIPAA and Sarbanes-Oxley, the PCI Standard and Security Program rules are not statutes or regulations enforced directly by the government. Rather, the PCI Standard and the Security Program rules are imposed and typically enforced contractually through the PCI Contract Chain. At the top of the chain are the payment card companies. The payment card companies establish merchant relationships by working through "merchant" or "acquiring" banks. The contract between merchant banks and payment card companies is the first contractual relationship in the payment card industry chain. The merchant banks (or payment processors working with the merchant banks) process the payment card transactions for the payment card companies they partner with. If a merchant wants to be able to accept payment cards to transact business, it must be vetted by a merchant bank (or payment processor) and enter into a contractual relationship with that merchant bank (or payment processor). Finally, merchants sometimes enter into relationships with service providers for the processing, storage or transmittal of payment card data. As the final link in the chain, merchants and service providers will enter into contractual relationships. This presents several legal issues:

1. No Direct Contractual Relationship between Merchants and Payment Card Companies. The significance of the chain is that there is typically no direct contractual relationship between payment card companies and merchants. Therefore, generally speaking, merchants cannot be directly required to legally adhere to Security Programs or the PCI Standard by payment card companies. Rather, if any contractual obligations do exist they are passed through the contract that exists immediately upstream from the merchant (e.g. the contract between the merchant and merchant bank or payment processor). Nonetheless, in practical terms, payment card companies may be able force compliance by leveraging their relationships with merchants and access to payment card processing.
2. No Direct Duty for Service Providers to Comply with PCI or Security Programs. There is typically no inherent duty for a merchant's service providers to comply with the PCI Standard Any duty for a service provider to comply with the PCI Standard will flow contractually from the merchant to the service provider (typically not from the payment card companies to the service provider). Therefore, unless merchants impose contractual obligations on their service providers, they may find themselves without leverage to force those service providers to become PCI compliant.
3. A Merchant Compliance with PCI is Directly Contingent on Contractual Obligations Imposed on its Service Providers. Section 12.8 of the PCI Standard requires merchants to do the following:

   If cardholder data is shared with service providers, then contractually the following is required:

   12.8.1 Service providers must adhere to the PCI DSS requirements

   12.8.2 Agreement that includes an acknowledgment that the service provider is responsible for the security of cardholder data the provider possesses.

   If these duties are not contractually established then the merchant may not be able to establish its own compliance with PCI.

5. Matching Upstream and Downstream Obligations and Risk. The scope of a merchant's PCI obligations (including compliance with the PCI Standard and Security Programs) is dictated by its upstream contracts with merchant banks or service providers. Merchants must protect themselves by imposing upstream PCI contractual obligations and risks downstream to their service providers. So if a merchant agrees to pay fines and penalties for failure to comply with PCI, it should also require its service providers to pay any fines and penalties imposed on the merchant because of the service provider's failure to comply.

The contractual nature of PCI makes it necessary for a merchant's legal staff to understand and become involved in the PCI compliance process. Most of the issues outlined above require legal analysis, contract drafting and negotiation. Attorneys should develop strategies for limiting liability from upstream contracts, and passing liability downstream to service providers. One area of special difficulty is existing service provider relationships. If a merchant faces fines or the loss of processing capability because its existing service providers are not PCI compliant, it could be difficult to re-open negotiations and force service providers to invest the time and resources to become PCI compliant. As such, before fines and threats start coming in, a merchant's legal staff should be devising a strategy for addressing PCI contractually with existing service providers (as well as new providers). While these contractual issues are challenging, the transformation of PCI into a legal standard of care can pose even greater difficulties for an organization.

PCI as a Legal Standard of Care

The PCI Standard is transforming into the legal standard of care for merchants handling payment card data. As a result, merchants may find themselves liable to financial institutions and/or consumers if they fail to adhere strictly to the PCI Standard. Unfortunately, PCI compliance is often viewed purely as a security exercise without high (or any) involvement from a merchant's legal team. As PCI increasingly becomes a legal standard, attorney participation (including the use of attorney-client privilege) is a necessity in order to decrease liability risk. This section discusses how PCI is evolving into a legal standard, including: (1) under the common law in support of a "negligence" claim; and (2) explicitly in recently proposed and passed State legislation.

PCI as the Standard of Care for a Negligent Security Suit

Negligence is a legal theory of recovery that exists in "common law" - negligence claims do not involve laws passed by legislators or regulators. To prevail in a negligence suit, a plaintiff must establish the following: (1) a duty to use ordinary care; (2) breach of that duty; (3) a proximate causal connection between the negligent conduct and the resulting injury and (4) resulting damage. Negligence is a theory used to support liability actions as simple as slip-and-fall lawsuits to complex environmental disaster lawsuits. In the PCI context, plaintiffs can allege negligence by arguing that a merchant handling payment card data has a duty to protect such data, and the failure to comply with the PCI Standard represents a breach of "ordinary care" if the merchant suffers a security breach. However, even if a breached duty can be established, plaintiffs still must prove that a security breach suffered by a merchant caused them damages. As discussed further below, while it has been difficult for consumer and financial institution plaintiffs to establish damages, recently passed and future legislation may make it easier for financial institutions to recover from merchants. The use of the PCI Standard to support a negligence claim was recently demonstrated in the TJX matter. In that case several banks sued TJX for the costs to reissue credit cards (amongst others) in the wake of a massive security breach suffered by TJX involving millions of card numbers. To support their allegations of negligent security, the banks retained an expert to critique TJX's security posture. That expert relied on TJX's own PCI audit reports (performed by security firms hired by TJX) to argue that PCI breached its duty of ordinary care to protect payment card data. A copy of that expert opinion can be found by clicking here. The bank's expert noted that TXJ's auditors concluded that TJX satisfied only 3 of the 12 sections of PCI. In addition, the expert opinion noted specific security failures tied to the TJX breach that can also be traced back to PCI requirements. For example, TJX allegedly stored "Track 2" data which can be used to recreate the magnetic strip of a payment card, which would be a violation of section 3.2. of the PCI Standard. The end result was a $41 million settlement and tens of millions in legal fees and other costs It is uncertain to what extent TJX's legal team was involved in the post-breach response, whether TJX took steps to try to shield its auditor's actions with attorney-client privilege, and if so, whether it asserted that privilege in court. Nonetheless, it is clear that conducting a PCI audit and taking steps to comply with PCI has significant legal repercussions -- any adverse finding of non-compliance that is not shielded by attorney-client or attorney work product privilege can be used by plaintiffs against a merchant. These admissions of non-compliance can result in merchant liability, especially when used in conjunction with a new species of laws that requires adherence to PCI.

Plastic Card Protection Laws - PCI Incorporated Into New State Laws

Even more troubling for merchants of all sizes, are new proposed bills, and at least two passed laws, that provide banks with a right to obtain reimbursement from merchants that suffer a security breach exposing payment card data. In essence, these bills allow banks to get around proving the "damages" element of a negligence claim, and arguably provide for "strict liability" in the event a merchant suffers a payment card security breach. Prior to such laws, financial institutions lost some high profile lawsuits, in part, because of an inability to prove damages (see for example the B.J. Wholesalers' lawsuit: B.J. Wholesaler Summary Judgment Ruling and PSECU Motion to Dismiss). Some of these Plastic Card Protection bills/laws directly incorporate PCI as the requisite security standard for payment card data. Several States have proposed bills allowing banks to seek reimbursement for security breaches, including Massachusetts, Illinois, Connecticut, Texas, Minnesota, California, Michigan, Alabama, Iowa and Washington. While many of these bills are in limbo or may not pass, they demonstrate a willingness on the part of lawmakers to seriously consider relief for banks and incorporate PCI into law (TX, CA, MI, MN, IA and AL all tie PCI compliance to their bills). In fact, Minnesota has actually passed laws providing banks with a right to seek reimbursement after a merchant suffers a breach. This law represents a paradigm shift in terms of merchant liability and compliance. The multiplier effect of damages for a payment card security breach (e.g. $20-50 allegedly per card multiplied by thousands or tens of thousands of exposed payment card numbers) has the potential to literally wipe out small and medium organizations, and severely damage even large companies. These costs were previously unrecoverable (or at least very difficult to recover) because of the pre-emptive nature of reissuing cards to avoid potential future fraud. Minnesota's Plastic Card Protection Act ("Act") incorporates, in part, the requirements of Section 3.2 of the PCI Standard. To comply with the Act, companies accepting payment cards must destroy or delete sensitive authentication data (including the same "Track 2" data that TJX allegedly stored) within 48 hours of authorizing a transaction with such data (the "48-hour rule"). If a merchant violates the 48-hour rule and suffers a breach exposing payment card data, banks can recover reasonable costs associated with addressing that breach (including the costs of reissuing new payment cards, opening and closing accounts, etc.). This Act also applies to entities using service providers that store, process or transmit payment card data - a merchant that provides sensitive authentication data to a service provider will be in violation of the Act if its service provider does not comply with the 48-hour rule. The reach of the Act is potentially nationwide - merchants only need to be "doing business" in Minnesota for it to apply - the Act is not limited to the exposure of payment card data of Minnesota residents. "Doing business" in the legal context could be as simple as having a commercial website accessible in Minnesota. Section 3.2 of PCI, in fact, prohibits the storage of sensitive authentication data for any period of time. So, if an organization is strictly in compliance with section 3.2 of PCI, it should also not be in violation of the 48-hour rule. Significantly, some of the other bills incorporating PCI incorporate multiple sections of PCI, and in the case of Washington State and Texas, the entire PCI Standard. While these Plastic Card Protection laws do provide a direct path to liability, what is the problem for companies that consider themselves PCI compliant? As discussed further below, even for PCI compliant merchants, there are several problems that arise out of the PCI standard and framework, and the use of a private security standard as a public legal standard to be ruled on by judges and juries. The next section explains the problems with PCI as a legal standard both in terms of its administration by the PCI Council and payment card companies, as well as the risk of handling PCI as solely a security matter.

PCI: A Law Without A Judge or Jury

The overarching problem with PCI is that it is a security standard that is becoming a law. Unfortunately, the PCI Standard was not necessarily drafted like law; nor is it interpreted like a law. Rather it is interpreted by non-lawyer security professionals solely as a security standard - either qualified security assessors (QSAs) or a merchant's internal security team (in the case where a self-assessment is appropriate). There often may be no awareness as how security interpretations will be viewed by a court of law, and little to no lawyer involvement. In addition, unlike laws passed by lawmakers, there is no mechanism for resolving ambiguities or exceptions to the PCI Standard. No body similar to a court or regulator exists in the PCI context to create precedent or provide official guidance that can be relied upon by the merchant community to make compliance decisions.

PCI Ambiguity

During the September 2007 PCI Council Meeting in Toronto it was revealed that there had been hundreds of questions submitted concerning the interpretative uncertainty arising out of the PCI Standard. Unfortunately, as PCI becomes a legal standard, the ambiguities inherent in the PCI Standard could lead to legal liability. The problem is compounded because there is no official body within the PCI framework to resolve those ambiguities and provide merchants with guidance on how to comply with PCI. A good example is section 12.8 of the PCI Standard, which reads:

If cardholder data is shared with service providers, then contractually the following is required: 12.8.1 Service providers must adhere to the PCI DSS requirements 12.8.2 Agreement that includes an acknowledgment that the service provider is responsible for the security of cardholder data the provider possesses.

Although section 12.8 seems fairly straightforward, according to some QSAs and merchants this language is subject to various interpretations. The following represent the range of interpretations that may apply:

1. Narrow interpretation: contract language indicates that service provider must adhere to the PCI Standard, which means that the minute the contract is effective the service provider must be PCI-compliant and the merchant should confirm such compliance;
2. Middle-ground interpretation: contract language indicates that service provider agrees that it must adhere to the PCI Standard, which means that the minute the contract is effective the service provider must be PCI-compliant, but the merchant does not need to confirm such compliance, but rather can trust the service provider's representation that it is compliant; and
4. Loose interpretation: contract language indicates that the service provider agrees that it must adhere to the PCI Standard, but the merchant has discovered that the service provider has some controls that need to be implemented to achieve full PCI compliance and imposes a deadline after the effective date of the contract to achieve such compliance in the future. Under this interpretation, the QSA would be effectively interpreting a merchant to be in compliance with 12.8.1 as long as the service provider contractually promises to adhere to the PCI Standard during the contract term by a certain reasonable date, even if not compliant at the inception of the contract. Stated differently, it is the "magic words" in the contract that matter not whether the service provider is actually PCI compliant.

It appears that the middle-ground interpretation meets the literal requirements of the PCI Standard. However, if this was presented in a court of law, a plaintiff would argue for the narrow interpretation (e.g. is it reasonable or within the spirit of PCI to simply rely on a vendor's promises without confirming actual compliance). Herein lies the problem: unless a merchant adheres to the strictest interpretation of the various sections of PCI, plaintiffs will always have arguments (and therefore leverage in a lawsuit) that the merchant was not in compliance with PCI. Remember, these lawsuits arise because the merchant has already suffered a security breach that will likely put the merchant in a negative light in front of a judge or jury. If the breach is at all related to the failure to comply with a section of PCI (and in many cases even if its not) the merchant will have a difficult time in court.

No Centralized or Official Binding Precedent Setting Body

Unlike laws, which have courts and regulators to render opinions and issue interpretative guidance that is binding and can be relied upon for planning purposes, the current system for PCI is ad hoc, decentralized and inconsistent. It has no mechanism for rendering "binding" decisions on interpretive differences. The following personal anecdote underscores this problem. Interpretative issues also arise under Section 12.8 with respect to new versus existing service provider relationships. For example, despite the indication that contractual language must be in place, at least one QSA has that it will pass a merchant on section 12.8 if the merchant gets a letter from its non-PCI compliant service provider indicating that the service provider intends to comply with PCI some time in the future. The QSA that asserted this position informed me that this approach had been approved by the PCI Council and/or payment card brands in some sort of writing. I attempted to get that writing from the QSA as well as a sample of a proper letter so I could advise my clients on this short-cut, but the QSA could not produce the document. Therefore I attempted to communicate directly with the PCI Council on this issue. The PCI Council refused to answer my questions and confirm the short-cut despite the fact that this issue dealt directly with the PCI Standard (and not a payment card brand Security Program). Instead, the PCI Council told me I had to get an answer from each of the payment card companies. I followed through by sending the question to each of the five major payment card companies. Three companies simply did not reply (JCB, Discover and MasterCard). American Express replied, but indicated that it was not in a position to make that determination and that it was up to each merchant's QSA to make the decision. A representative from VISA, however, provided a partial answer to my question:

In general, the Service Provider's legal counsel may provide the assessor documentation/letter that 12.8 requirement is being addressed in existing (or future) contracts despite not having the exact 12.8 language. The main goal is to stipulate the accountability for keeping the cardholder data secure and responsibility in any compromise event

I asked for some further clarification on this answer, but there was no response to my follow-up e-mail. There are several problems with this approach now that PCI has effectively become the law. First, its clear that there is no centralized decision-making body to render decisions on PCI ambiguities. The PCI Council passed the buck to the payment card brands, and AMEX passed the buck to the QSAs. There are hundreds of QSAs, so potentially hundreds of different interpretations. Moreover, each payment card company may have a different view of how to interpret 12.8. This does not take into account payment processors and merchant banks that are also known to take their own positions on PCI. While VISA did provide an answer, it would likely not be binding upon any of the other card brands. In fact, since VISA's comment is outside of a contractual setting it may not even be binding against VISA itself (e.g. there is no direct contractual relationship between VISA and the merchant). Moreover, its typically consumers, payment card processors, issuing banks and merchant banks that would sue or fine a merchant because of a security breach. How would an email from VISA be binding on those organizations? As PCI is becoming the law a system without a centralized decision-making body to resolve interpretative differences poses significant liability risks. Under a legal system, courts resolve interpretative differences in lawsuits or regulators provide interpretative guidance (see e.g. the HHS and HIPAA and the FTC and GLB). While that system is imperfect for several reasons, at least at the end of the day legally binding precedent is created. Organizations can rely on the court's opinion or regulators' guidance to make their own decisions on various interpretations with some certainty that those decisions will be legally binding. Those decisions and guidance are available for the entire world to read and they end up creating consistency across the business community in general. Unfortunately, the PCI system is extremely decentralized and uncertainty abounds. The PCI Council reportedly may begin addressing this issue by issuing a series of "FAQs" to address interpretive issues. However, even with FAQs, the legally binding effect is uncertain. Are FAQs rendered by the PCI Council binding on merchant banks and payment processors that have contracts with merchants? The PCI Council should consider establishing an official centralized body that renders interpretative decrees that become part of the PCI Standard itself and that are binding on all of the participants in the PCI contract chain. In addition, merchants should take steps to have their attorneys deeply involved in PCI compliance efforts to reduce the risk of liability - the Standard needs to be viewed as a law, not merely a security standard.

Security Analysis versus Legal Analysis

The reality right now is that non-lawyer QSAs are making the essential decisions on PCI compliance for merchants. However, their interpretations of PCI are made through a security prism, not a legal prism. Moreover, some QSAs may accept looser interpretations of the PCI Standard because of economic incentives (e.g. preservation of client relationships) or pressure from their merchant clients to "pass" them. While looser interpretations may be fine in the security world in some areas, some of those interpretations may be ripped apart when scrutinized by a plaintiff's attorney and/or judge or regulator. From a legal standpoint, merchants should assume that the narrowest interpretation of the PCI standard will be used against them in a court of law. Plaintiff's attorneys will present expert witnesses who will testify in favor of the narrow and literal interpretations of PCI, and those experts will have the actual wording of the PCI Standard to back them up. In addition, those experts will use any and all adverse security assessment findings, including those made by the merchant's own auditors, against them. If PCI is not approached through a legal prism (in addition to a security prism) the liability risk increases. Attorneys should be used to attempt to shield adverse assessment opinions as well as to scrutinize the security team or QSA's interpretation of the PCI Standard. Attorneys should also be used to assist in the development of written policies and procedures, as well as documenting compliance with the PCI standard where appropriate. As the legal risks continue to grow, relying solely on security professionals for PCI compliance will not be an option.

Action Items for Merchants

As the PCI Standard increasingly becomes the law, merchants need to adjust their practices and develop a more legally-oriented approach to PCI compliance. On the security side merchants should consider the following:

1. Choose QSA's wisely. Right now QSAs are the interpretative bodies of PCI. If a merchant uses a "fly-by-night" QSA it may be opening itself to risk. Merchants should use QSAs that are not afraid to give the merchant "bad news" and that understand how their interpretations may be viewed in a court of law.
2. Insurance. Make sure that your QSAs are fully insured for their errors and omissions, and try to get named as an additional insured on their policies if possible. In addition, the merchant should check its own policies to determine whether it is covered if one of its service providers suffers a breach or if the merchant is required to pay a fine or penalty for non-compliance with PCI.
3. Not a Rubber Stamp. Despite potential pressures to become PCI compliant quickly and at the least cost, merchants should not view their QSAs as "rubber stamps" of PCI compliance. QSAs, like all professional service providers, enjoy happy clients and will work hard to please their clients. However, if this causes them to take short cuts or apply loose interpretations, it could come back to haunt the merchant in the long run.
4. Develop Relationships with General Counsel. The merchant's security team needs to engage the general counsel (or other members of the merchant's legal team). Many attorneys are intimidated by technology and security issues and may not be aware of the legal issues surrounding PCI compliance. Internal security professionals need to act as the expert advisors to the merchant's legal team and work together to translate security practices into legally compliant practices.
5. Narrow Interpretations. To reduce risk of liability, security professionals should err on the side of interpreting the PCI Standard literally and narrowly. Of course this may conflict with other goals such as keeping expenses down and avoiding business disruptions. The security team should work with the merchant's business decision-makers and risk managers to achieve a balance that reflects the organization's risk tolerance.

The merchant's legal team also needs to get involved in the PCI compliance process, including:

1. Reaching Out to the Merchant's Security Team. Security professionals are often intimidated or uncertain about the law. Security professionals are not lawyers, and they need information to understand how the legal system scrutinizes and judges their activities and decision-making process. The merchant's legal team needs to translate legal and compliance concerns into terms that allow the merchant's security team to implement legally compliant security controls.
2. Use Attorney-Client Privilege. Any adverse PCI compliance finding or assessment can and will be used against a merchant in court. Moreover, drafts of security and privacy policies, and documents (e.g. emails) surrounding the creation of such policies and practices, can be used against an organization in court. Some of the activities and documents of a merchant's internal and external security team may be shielded using attorney-client privilege or attorney work product privilege. While such privileges are not foolproof by any means, taking steps to preserve the privilege may at least pose an obstacle in litigation. Attorneys need to get involved early on in the compliance process to make this work.
3. Analyze Upstream and Downstream PCI-Related Contracts. Much of the legal risk associated with PCI is contractual. Merchants cannot know their risk unless they know their contractual obligations and rights. Attorneys need to understand upstream contractual risk, and use their contracts to pass it on to service providers downstream.
4. Draft Strong Service Provider Contracts. Attorneys should draft strong service provider contracts that require compliance not only with the PCI Standard itself, but also the specific Security Programs of each payment card company program that is applicable. These contracts should address section 12.8 of PCI, as well as providing assessment and audit rights, breach notice and remediation obligations, indemnification clauses and insurance clauses
5. Develop a Service Provider Strategy. Service providers are likely to resist the imposition of additional PCI duties. A merchant's legal team should have contract language and a negotiation strategy developed ahead of time. The strategy should address both new service provider relationships and existing service provider relationships. For existing relationships, the merchant may be highly dependent on its service provider and may lack leverage to re-open contract negotiations. Nonetheless, an approach should be developed to persuade existing service providers to become PCI-complaint before the merchant is fined or receives threats to have its payment card processing privileges revoked because of the service provider's non-compliance.
6. Strict Compliance - Upstream Waiver. If strict compliance with PCI is not possible, try to get a written waiver from the merchant's upstream contractor (e.g. payment processor merchant bank). The best case scenario is to get a formal amendment to the upstream contract reflecting the waiver. While this may not fully protect the merchant from third party suits, it may be helpful in contract disputes with the upstream contractor.

Conclusion

As the legal ramifications of PCI continue to develop and increase, PCI compliance will become an increasingly risky endeavor for merchants. Unfortunately, because the system is run privately by the payment card companies and does not have a centralized body to provide binding guidance and rulings, the system may pose more risk than a traditional governmental regulatory scheme. Regardless, now is the time for merchants to begin engaging their legal teams to address PCI compliance, and opening the lines of communication between the lawyers and security pros. It is also the time to start pressuring the PCI Council and payment card brands to develop a centralized body to provide publicly available and binding guidance and decisions resolving ambiguities within PCI. If these actions are not taken, the PCI Standard could present significant liability challenges for the retail community.