Evan Schuman's StorefrontBacktalk

There are quite a few merchants who feel that the drive to PCI compliance has caused them to make some security technology choices that are contrary to their system architectures and prior planning. Others have expressed concerns that they are simply not able to process all the data they are collecting from their various auditing and logging tools, which means they are getting little value from the many thousands of dollars they have spent, other than the "PCI Compliant" seal of approval. Read more...

But Visa helped those numbers look stronger by removing from the list some 38 level 1 retailers that weren't going to make their PCI deadlines and extending their deadlines to Sept. 30, 2008.

There are only 364 Level 1 retailers, which are merchants that process more than 6 million Visa transactions a year. Visa did the same thing for the 1,011 Level 2 retailers, only there it excluded 302 merchants, who were given until Dec. 31, 2008.Read more...

One day he's in a parking lot and discovers that someone placed a huge scratch along the right side of the car. His insurance company inspects and awards him a large check to have the car completely repainted. Instead, the man uses the check to buy a new state-of-the-art audio system. The way that Chicagoan views his insurance check is how many IT leaders see PCI requirements. Read more...

But there is a huge IT frustration with those mobile devices when it comes to retail employees. It's not the fact that most new retail tech capabilities are mobile and experimental, which just begs the data breach Gods to punish managers. That's less frustrating than infuriating. Read more...

The panel included Google's head of retail, John McAteer, Borders' E-Commerce chief, Kevin Ertell, the corporate development VP at Bill Me Later, Mark Lavelle, Ursula Milan, an E-Commerce manager at the Museum of Modern Art, and the dean of the E-Commerce analytics corp, Jupiter Research's Patti Freeman Evans. Read more...

The disk, which was apparently discovered missing in October, was placed in Iron Mountain's custody by GE Money, which handles credit card data for J.C. Penney and as many as 100 other retailers. Read more...

"Those newly recorded projects represented 20 percent growth in the size of the database, reflecting the rapid growth of the market way beyond the Chinese ID card," said IDTechEx CEO Raghu Das. "We could have added more than 500 more consumer goods companies mandated by retailers to tag pallets and cases but that would be living a lie because most of these are doing little or nothing in the face of the huge financial cost and lack of payback if they comply." Read more...

The Wegmans Food Market chain is going to trial whether RFID-tagged prescriptions could make processing orders more accurate and fast, according to this story in RFID Journal.

But the more controversial aspect of the trial will be looking at “how the usefulness of RFID tags on individual pill bottles or blister packs could be extended beyond the point of purchase. For this application, they’re seeking partners interested in developing in-home RFID tag interrogators that consumers could use to organize their drugs and manage when and how much they should take.”…

Wal-Mart is threatening Sam’s Club suppliers with a $2 to $3 fine for each non-tagged pallet as of Jan. 31, according to this intriguing RFID Update story.

The story reported that Wal-Mart has “discussed the possibility of allowing suppliers to raise prices to help offset tagging costs.”…

No, that won't work. As much I try, it's hard to pretty up a retail technology/E-Commerce panel as an exciting outing. But for a tech-biz discussion, we've got two decent offerings. On Wednesday morning (9:45-10:45 AM, at the Javits, Concurrent Hall A 1A21/22), StorefrontBacktalk will be moderating a look at The Road To Merged Channel. Read more...

IT investments will increase by 4.3 percent this year, thanks mostly to small- and medium-sized retailers spending to become PCI compliant, according to a new report from IHL.

“PCI compliance has come down to the small and medium businesses,” said IHL President Greg Buzek. “That starts to drive a lot of upgrades.”…

But as I was looking at two unrelated privacy legal filings on Friday, was struck by the different legal tactics and the very different probability of success. This all stems from two unrelated privacy breaches from three deep-pocketed companies: $52 billion Sears, $41 billion Sprint and $36 billion Wells Fargo. Read more...

But is the guarantee legitimate if the retailer controls the terms? Read more...

The Sears move came hours after Harvard Business School Assistant Professor Benjamin Edelman published details on how consumers using Sears' ManageMyHome site could find detailed purchase histories about other Sears shoppers merely by typing in their name, phone number and street address into the site. Read more...

But the chain is also learning that the online world—with its thousands of bloggers armed with screen captures—is fairly unforgiving when it comes to marketing excesses. Read more...

The timing of this nation-wide hiccup couldn't have come at a worse time for retailers. Merchants and giftcard exchange sites have been pushing giftcard convenience more aggressively this year than ever, positioning it as the ultimate hassle-free gift. To have that network crash on Dec. 26—one of the busiest days for gift returns and gift card redemptions—is certainly not ideal. Read more...

Noticed the Christmas Day report in The Boston Globe that TJX had created two new positions: chief privacy officer and privacy director and was intrigued.

The story was based on an October memo from a TJX search firm that it was looking to fill the privacy director role and that it had quietly promoted an existing TJX executive– Jeffrey Naylor, senior executive vice president for administration and business development—to the chief privacy officer role.

What does this all mean? If TJX is telling the world that it is now taking privacy seriously, then why did it never announce the creation of chief privacy officer? How does creating this position change any of the ROI issues that caused them to not invest as heavily as they could have in security? …

The arguments raised are similar to the total cost of ownership (TCO) strategies that were all the rage a few years ago, but they take it one step further. Read more...

“More than 95 percent” of the Visa-issuing banks have agreed to a multi-million settlement worked out between Visa and TJX, TJX announced late Thursday.

The announcement—which came one day after the deadline for the banks to accept and two days after TJX had negotiated separate settlements with other banks suing them—cleans up some of the last remaining loose threads from the TJX case. Read more.…

The choice of whether the self-assessment option is available to Level 1 merchants varies by card brand, but Visa is now selectively permitting it. Officially, the issuing bank and the card brand must agree before a Level 1 is given the self-assessment permission and it's often approved for re-certification, once a retailer has already been certified PCI compliant.Read more...

Almost all of the banks and bank associations still suing TJX agreed to settle for undisclosed sums on Wednesday, in an anticipated move following the collapse of bank’s the federal class-action lawsuit against TJX. This all stems from the worst-ever data breach in credit card history, impacting more than 100 million credit/debit cards.

TJX CEO Carol Meyrowitz issued a statement that TJX has finally achieved PCI compliance. Read more.…

Consumers who have been fairly nonplussed by repeated reports of retail data breaches are expressing more worries about gift card frauds, fueled by retail lobbing groups.

This story in the California daily newspaper, The Fresno Bee details how at least one gift card exchange site, Otartel.com, “has disappeared completely.”…