Washington Becomes Third State to Enact a Law Connected to PCI DSS

Article by Molly T. Eichten and James Graves

Anyone who deals with credit card data is probably familiar with the Payment Card Industry Data Security Standard. PCI DSS requires anyone who stores, processes, or handles payment cards to meet certain technical and process requirements. Larger merchants and service providers must pass regular external security assessments, and everyone subject to PCI DSS must undergo frequent scans for technical vulnerabilities. Failure to comply with PCI DSS can lead to significant fines in the event of a data breach.

In 2007, Minnesota became the first state to pass a law based on PCI DSS. The Minnesota law prohibits anyone conducting business in Minnesota from storing sensitive information from credit and debit cards. The law makes non-compliant entities liable for financial institutions' costs of canceling and replacing credit cards compromised in a security breach.