On August 7, 2014 the PCI Security Standards Council issued new guidance to supplement PCI DSS Requirement 3.0 and help organizations reduce the risks associated with entrusting third-party service providers (“TPSPs”) with consumer payment information. More and more merchants use TPSPs to store, process and transmit cardholder data or manage components of the entity’s cardholder data environment. A number of studies have shown that breach is tied increasingly to security vulnerabilities introduced by third parties. To combat such risk, a PCI special interest group made up of merchants, banks and TPSPs, together representing more than 160 organizations, created practical guidelines for how merchants and their business partners can work together to comply with the existing PCI standard and protect against breach.
Financial Privacy
California Supreme Court Holds Online Retailers of Downloadable Products May Require Personally Identifying Information For Credit Card Transactions
Posted on
The California Supreme Court held on February 4, 2013 that the provision of the Song-Beverly Credit Card Act of 1971 (the “Act”) prohibiting retailers from requesting personally identifying information as a condition to processing credit card transactions does not apply to online purchases of electronically downloadable items. (Apple v.
Alternative Trading System Agrees to Pay $800K for Failure to Protect Confidential Information
By Amy Crafts on
Earlier this month, the Securities and Exchange Commission (“SEC”) instituted public administrative and cease and desist proceedings against eBX, LLC (“eBX”), a broker-dealer registered with the SEC. eBX operates LeveL ATS, an alternative trading system (“ATS”) known as a “black pool,” which is a proprietary market where traders may exchange…
Door to Increased Liability for Banks Opened by U.S. Court of Appeals for the First Circuit
By Kristen J. Mathews on
‘Patco Construction Co., Inc. v. People’s United Bank’ ‘online banking’ authentication
…
Broker and Compliance Officer of Broker-Dealer Firm Personally Fined by SEC for Customer Privacy Violations
By Jeffrey Neuburger on
On April 7, 2011, the SEC announced that it had imposed fines of $20,000 each against the former president of a broker-dealer and a former broker for their actions in transferring customer information to a new firm as the defunct firm wound down. The SEC also fined the brokerage firm’s former chief compliance officer $15,000 for compliance failures and security breaches that took place at the defunct firm, some dating back to 2005. Visit our blog to learn more.
…
PCI Security Standards Council Unveils New Data Security Standards
By Proskauer Rose on
On Thursday, October 28, 2010, the PCI SSC promulgated version 2.0 of its Data Security Standard and its Payment Application Data Security Standard (“PA DSS”).
…
Superiority Beats Enormity: 9th Circuit Rejects Denial of FACTA Class Certification Based on Disproportionality of Damages
By Proskauer Rose on
In a decision filed September 27, 2010, the U.S. Court of Appeals for the Ninth Circuit reversed a California district court’s refusal to certify a class action alleging violations of the Fair and Accurate Credit Transactions Act (“FACTA”). The Ninth Circuit ruled that none of the three grounds advanced below – the disproportionality between the potential liability and the actual harm suffered, the enormity of the potential damages, or the defendant’s good faith compliance with FACTA after being sued – justified denying class certification on superiority grounds. The Ninth Circuit’s decision narrows, if not eliminates, the potential for disagreement among district courts on an issue that has for some time been a fly in the ointment for class action plaintiffs (and their attorneys) hoping for big paydays on account of harmless technical violations of FACTA.
…
Seventh Circuit Affirms District Court Decision that “Electronically Printed” Receipts Under FACTA Does Not Include Receipts Emailed to Consumers
By Charley Lozada on
On August 10, 2010, the U.S. Court of Appeals for the Seventh Circuit upheld an earlier ruling by the Northern District of Illinois Eastern Division that email order confirmations are not “electronically printed” receipts under the Fair and Accurate Credit Transactions Act (“FACTA”) amendments to the Fair Credit Reporting Act. Shlahtichman v.1-800 Contacts Inc., Case No. 09-4073 (7th Cir.; Aug. 10, 2010). The court affirmed the dismissal of Shlahtichman’s complaint against 1-800 Contacts Inc. that involved an electronic order confirmation containing Shlahtichman’s credit card expiration date.