Evan Schuman's StorefrontBacktalk

But that scenario still assumes the person answering the compliance question even knows the answer. What if he or she is confused about what constitutes prohibited data? Much more likely, what if that person believes the retailer is not storing such data but many of his or her colleagues are secretly doing it? (Marketing. Always blame marketing. When seeking out an ethics-challenged department, marketing is universally a prime choice.)

To be fair, it doesn’t even have to be ethics-challenged. Other departments—and even some people in E-Commerce or IT—may simply not know the rules. At a large chain, data retention questions are simply impossible to answer honestly. But they are easy to reply to apathetically, because the answer being sought is so clear.

The 2009 Visa report brought some new “prohibited data retention” data points into the mix. For the first time, Visa added columns for Level 3 and Level 4 merchants. But the included data wasn’t especially helpful (“Not applicable” and “To Be Determined,” respectively). Visa also added VisaNet Processor (direct connection) and Agent (downstream). Rather than the 100 percent or 99 percent for Level 1s and Level 2s, though, VisaNet and Agent got the vague “high,” with no definition. (We assume “high” is better than the undefined “moderate.” It at least sounds better.)

So, does this mean that VisaNet and Agent are, to some unspecified extent (but presumably a lot higher than one percent—given Visa’s willingness to report 99 percent for years), indeed retaining prohibited data? That’s comforting.

Regardless, the key story here is merchant compliance and the failure so far to get the millions of merchants that account for a third of all Visa card transactions to be PCI compliant. What is good for large merchants should also be good for smaller merchants, especially because these smaller merchants self-assess (versus needing an outside assessment by a QSA) and they can use a self-assessment questionnaire (SAQ) that can be a short as 11 questions. Smaller merchants have been victimized disproportionately, and the consequences of a major breach and fine may mean bankruptcy.

A year ago, when StorefrontBacktalk PCI Columnist Walt Conway first started tracking these numbers, he figured the brands would turn their attention to small merchants in 2009. And Visa did indeed issue a series of mandates. But these requirements don’t seem to be having much of an impact based on the numbers Visa itself reports.

It will take a concerted effort on the part of the brands to make progress, and their only leverage is interchange. Incentive interchange rates successfully paved the way for broad adoption of electronic terminals at the point of sale back in the 1980s and 1990s. Maybe that approach can be used again to incent merchants to become PCI compliant and stay compliant. We’re not sure how it would work, but clever minds should be able to devise a program with appropriate incentives and penalties, like was done with CAP.

The only alternative is to have more mandates and acquirer reporting. Unfortunately, these requirements have had only “moderate” success so far. And yet it is hard to see widespread compliance coming about any other way.

One answer may be the acquirer-provided secure processing products that are announced weekly. We need to get to “plug-and-play PCI” that will work for the franchisee, college athletic department, golf course, theater and hardware store that is not compliant today and needs to be. Even with this approach, an interchange incentive from the brands sure would help.