Credit Card Companies Need Not Notify Consumers of Data Theft

A California judge ruled that Visa and MasterCard do not have to notify individual consumers whose account data was stolen by a hacker in a mass cybertheft disclosed by MasterCard earlier this year. JURIST has more. Read also the article of Bruce Schneier, a well known security expert, "CardSystems Exposes 40 Million Identities" relating to the background of this case. Schneier prefers a joint security standard, PCI (pdf), which includes several credit card companies. PCI requirements encompass network security, password management, stored-data encryption, access control, monitoring, testing, policies, etc. The credit card companies are currently already forcing companies that process credit card data to increase their security. These companies have to comply with PCI or face severe consequences. This is done independently of any laws or government regulations. Schneier concludes t…