Jessica Pineda sued Williams-Sonoma after a cashier asked for her zip code as part of a sales transaction. Pineda disclosed the information, which she believed she had to do in order to finalize her purchase. The CCA states:

No . . . [entity] that accepts credit cards for the transaction of business shall . . . request, or require as a condition to accepting the credit card as payment . . . the cardholder to provide personal identification information . . . which the [entity] accepting the credit card writes, causes to be written, or otherwise records upon the credit card transaction form or another.

In other words, it may be OK, as discussed below, for a business to ask for the information, but it certainly cannot record that information.

Pineda sued, arguing that her zip code was precisely the sort of personal identification information contemplated by the CCA, and alleging that the retailer used the combination of her name and zip code to locate her home address in violation of the Act.

The California Supreme Court agreed with Pineda and overturned a lower state court ruling that had reasoned that a zip code pertains not to an individual, but rather only to the entire group of individuals who live in that zip code. The Court found that a zip code does indeed constitute personal identification information and that once recorded in violation of the CCA, the retailer’s software then “reverse engineered” Pineda’s address from databases with millions of names. Serious business. The Court expressed particular concern that while the retailer was then able to put Pineda’s name into its own corporate database, which could be either (i) used for the company’s own promotional marketing, or (ii) sold to third-party businesses.

The Court’s reasoning began with the premise that the CCA, as a civil statute, should be construed “for the protection of the public.” Under this broad construction, the Court found that publicly protected information means “information concerning the cardholder” and thus was not limited to names and addresses, but also to zip codes, particularly in those instances where that number is not necessary to the transaction – e.g., where there is no shipping involved.

THE EVOLUTION OF CALIFORNIA’S CREDIT CARD ACT

Notwithstanding existing shortcomings, the CCA is far more refined than it was when enacted in 1971 to impose fair business practices for the protection of consumers. The original Act suffered from vague definitions, which are hardly uncommon in statutes. In 1990, the Act was amended specifically to address the misuse of personal information for marketing purposes. The California Senate Committee on the Judiciary stated that there was no legitimate need to obtain such information if it was not needed to complete a credit card transaction. In 1991, the Act was further revised to allow businesses to request certain information—for example, a gas station that requests a zip code in order to prevent credit card fraud—so long as none of that information is recorded. Robust consumer protection ruled the day, and the gravamen of both these revisions can be seen in Pineda. But it’s still not enough.

CREDIT CARDS, CONSUMERS, AND THE CALIFORNIA BUSINESS COMMUNITY AFTER Pineda

When I last ordered a pizza for delivery from a well-known franchise, the manager asked me for my zip code. I had just given him my street address, so I presumed his request was precisely along the lines of the gas station above. The franchise wants to prevent credit card fraud. I didn’t ask and then blindly put my trust in my own State’s consumer protection laws as they pertain to this matter. I merely assumed and hoped that those laws exist. As we consider these two examples—gas stations and pizza delivery franchises—it is important to acknowledge that we regularly are asked for our zip code and a wide range of information linked to our identity in the course of ordinary consumer transactions, and most of us probably give it little thought. To a great extent, that’s precisely why laws like the CCA are in place. The regularity of these requests should certainly be noted in California because Pineda will not be the final word on this matter. On the contrary, existing case law—and more to the point the CCA itself—leave too many questions unanswered.

As Dassoff advises, Pineda does not affect all business transactions affecting credit cards and zip codes. Rather, the CCA in facts allows businesses to collect personal identification information in four particular instances, including where personal information is required for a special purpose incidental but related to the credit card transaction, such as shipping, delivery, servicing, or installation of the purchased merchandise, or for special orders. (The other three exceptions are fairly technical, through hardly uncommon.) One could certainly argue that fraud protection (e.g., the gas station and pizza delivery hypotheticals above) should be included. And as Dassoff asks, what if a business requests a piece of personally identifiable information but doesn’t record it?  That’s allowed even under the 1991 revisions. But what does “incidental but related” really mean? And how about “information concerning the cardholder”? These terms—statutory in the first instance; common law in the second—are hardly precise. From a common law perspective, that question and others can only be resolved by future fact-specific cases that arise before the courts. However, there is another way: the legislative process. Amend the statute further to reduce inconsistencies that already are or can be foreseen as the subject of future litigation. And there is good reason to do so. Since Pineda was decided only six weeks ago on February 10, seventy (70) class actions have been filed against retailers for violations of the Act.

THE FAIR AND ACCURATE CREDIT TRANSACTION ACT : AN IMPORTANT PARALLEL FOR STATUTORY CLARIFICATION

FACTA presents an important historical parallel for the need for the statutory clarification of the CCA. FACTA precluded any business that accepted a credit card or debit card for a business transaction from printing more than the last five (5) digits of the consumer’s number or the card’s expiration date on the customer’s receipt. That hardly seems unreasonable. When enacted as revised, however, some technology—basic credit card processing machines, for example—had not been reformatted or rebuilt so as to comply with FACTA, so many businesses were immediately in violation of the Act, which led to a rush of lawsuits. Dassoff notes that “[t]his mass movement [of class actions after Pineda] is reminiscent of the class action suits filed against corporate defendants following the 2003 passage of the Fair and Accurate Credit Transaction Act.”  In the case of FACTA, the U.S. House of Representatives passed the Credit and Debit Card Receipt Clarification Act, which brought light to numerous then-unsettled issues.

CONCLUSION

For now, Pineda deserves the attention of all California businesses that accept credit cards, as well as online businesses selling to customers in that State. Businesses should scrutinize the way they collect personally identifiable information, and certainly any possible retention thereof, which constitutes a clear violation of the Act.  General counsel should watch closely the decisions of California courts and the manner in which this issue progresses nationwide. For those businesses willing to act collectively in order to effect change through the legislature, FACTA provides a highly relevant model of private interests having successfully clarified statutory vagueness without undermining the public good the statute is meant to protect.

___________

Ben Kerschberg is a Founder of Consero Group LLC. Mr. Kerschberg has a Bachelor of Arts in Foreign Affairs and German, summa cum laude and Phi Beta Kappa, from the University of Virginia and a Juris Doctor from Yale Law School, where he was as a Coker Fellow. He clerked for The Honorable Gilbert S. Merritt of the U.S. Court of Appeals for the Sixth Circuit.

You may follow Consero on Twitter @ConseroGroupLLC and Ben Kerschberg @benkerschberg.

Print Email 1 Comment Comments RSS ShareThis Ecommerce merchants frequently find themselves selling products in venues other than their web stores. Be it in-store trunk shows, pop-up shops, trade shows, boutiques, local fairs or even coffee shops, ecommerce merchants are there setting up booths and selling merchandise.

In the past, merchants had to run cash-only shops or process credit cards on a laptop, but extra outlets and a reliable Internet connection can be rare at these events. Now, merchants can process credit card transactions on their mobile devices with a host of mobile apps and dongles. (A “dongle” is hardware that attaches to a mobile device for a secure connection.)

I looked at the top twenty-five credit card processing apps with the (a) highest user ratings, (b) good reviews and (c) the most downloads for each of the top three mobile devices: Apple’s iPhone and iPad, phones running Google’s Android operating system and Research in Motion’s BlackBerry. I then handpicked from that group of 25 the most highly-rated and useful for each device.

Download these apps and start selling merchandise anywhere you can get a cell phone reception.

iPhone and iPad
1.Square. This handy app can be used with or without the proprietary Square dongle (it plugs directly into your iPhone or iPad headphone jack), so merchants can swipe or type-in card account information. Receipts are sent to the customer automatically via email. Square does not require a contract, and a merchant account is not required for use. It comes with some helpful tools to track sales, payment locations, tax, and top-purchasing customers. Square charges $.15 plus 2.75 percent for a swiped card and $.15 plus 3.5 percent for typed-in account information. App cost: Free.

2.iPay POS. One of the most flexible credit card processor apps, iPay POS is a good option for merchants that already have a merchant account — iPay POS is compatible with dozens of the most widely-used payment gateways. You can also set up a gateway with iPay POS for $7.50 per month. For a small merchant that may not attend many events, iPay POS comes with 10 free transactions and additional sets of 10, each for $.99. Or for a merchant with a larger budget, $29.99 will allow for unlimited transactions. It has limited compatibility with dongles, but it is compatible with the iMag credit card swiper and portable receipt printers like the RedFin P25-M. App cost: Free.

3.Credit Card Terminal. One of the most widely-used credit card processing apps, Credit Card Terminal can process all major credit cards, handle full and partial refunds on returns, allows for digital signatures to be captured on-screen and PDF receipts can be emailed directly from the app. It is compatible with an optional Innerfence card reader dongle. Authorize.Net processing rates of $.25 per month plus an additional 1.74 – 3.79 percent rate depending on transaction type, also apply. Credit Card Terminal is only for use with Authorize.Net accounts. App cost: $.99.

4.Swipe It. Use the app by itself to key in credit card account information or in conjunction with the Swipe It Reader for card swiping on your iPhone, where you can capture a customer’s signature right on your phone and email receipts automatically at the end of sale. Merchants must set up an account with Swipe It’s proprietary EPay gateway, which costs $15 (a one-time set up fee), then $20 per month and $.15 per transaction. App cost: Free.

BlackBerry
1.BlackCharge. Limited in payment gateway options, BlackCharge is only compatible with Authorize.Net, NMI and PayPal Payflow Pro. If you don’t have a merchant account, you can set one up through NoblePay. The app costs $4.99 and BlackCharge does not add additional fees or take a percentage for transactions, but the standard transaction rates for the compatible merchant accounts still apply. App cost: $4.99.

2.MerchantWARE Mobile. Process credit cards on the BlackBerry Storm, Curve, Pearl and Bold with this free app and email your customer a receipt at the end of the transaction. Although the MerchantWARE Mobile app is limited to use to a Merchant Warehouse — makers of MerchantWARE — merchant account, there are no additional gateway transaction fees or percentages, just the monthly cost of the merchant account, which varies depending on merchant needs. The app is also compatible with MagneSafe BT90 wireless Bluetooth credit card reader. App cost: Free.

BlackBerry running MerchantWARE.

3.vTerminal. Accept credit cards with this very simple app, which is also known as ChargeBerry. It doesn’t offer a lot of additional tools, but it allows the entering of numbers from major credit cards without having to use a swiper dongle. It has limited payment gateway compatibility, as it only works with Authorize.Net or PayPal Payflow Pro. There are no additional fees after the $9.99 download purchase, but standard gateway fees apply. App cost: $9.99.

Android
1.Mobile Merchant Pro. This free Android app provides a very simple, no-frills way to accept all major credit cards. It has limited gateway support, but it is compatible with two of the most popular gateways: Authorize.Net and PayPal Website Payments Pro. Simply type in the customer’s credit card info and click “Charge Now” and that’s it. No additional transaction fees from Mobile Merchant Pro, but standard Authorize.Net and PayPal gateway fees apply for each transaction. App cost: Free.

2.Merchant on the Move. Primary Merchant Solutions’ robust credit card processing app works in conjunction with the proprietary Merchant on the Go card swiper and receipt printer. The app allows for customer signature capture and either typed-in or swiped credit card processing. Merchant on the Move can only be used with a Primary Merchant Solutions’ merchant account, which comes at a cost of $24.95 per month. For each transaction, merchants are charged $.30 plus 1.69 percent for swiped card and 2.2 percent for typed-in account info. App cost: Free.

4.ROAMpay. QuickPay Merchant Services ROAMpay app works in conjunction with a provided dongle, allowing users to swipe cards or type-in account information. A wide variety of merchant account gateway options is available, all with standard — but competitive — monthly usage fees and transaction percentages. Built-in tools allow for customer data tracking and search, emailing of receipts, handling of voids and refunds, and you can even record transactions offline when out of wireless coverage and then upload the transactions when you are back in coverage. App cost: $2.99.

Investigators will look into financial incentives providers receive for promoting the cards that can leave patients struggling with overcharges and high interest rates, Cuomo said.

“You can’t wear two hats in the operating room,” the attorney general and Democratic candidate for governor said in Buffalo. “You can’t have the hat of a doctor and the hat of a financing agent at the same time. That’s a conflict of interest.”

Subpoenas have been issued to 10 providers, some with multiple offices, that promote GE Money’s CareCredit card, Cuomo said. Meanwhile, medical associations that endorse the card, including the American Dental Association and American Society of Plastic Surgeons, are being asked to explain their support.

Cuomo’s office also issued subpoenas to learn how three other health care card programs are run: Chase Health Advance, Visa Health Benefits and Citibank Health Card.

Cuomo said providers have been urging cardholders to finance procedures including dental work, cosmetic surgery and veterinary services not covered by insurance and even when they can pay in cash. He said CareCredit, for instance, charges providers a fee to offer the card and rebates part of the fee based on how much business the providers get consumers to charge.

Providers are paid within two days of the charge, giving them even more incentive to push the cards, Cuomo said.

“Health care debt is the number one cause of individual bankruptcy and this scheme is contributing to the economic burden being felt by consumers,” Cuomo said.

GE Money, a subsidiary of Fairfield, Conn.-based General Electric Co., received a subpoena to provide its customer list. The card is accepted by more than 125,000 health care practices nationwide. The company did not immediately respond to an e-mail request for comment.

Philip Palumbo, 80, of Rochester said he signed up for CareCredit to pay for an estimated $5,600 in dental work, not realizing he was agreeing to a credit card. After having the work done elsewhere, he continued to receive bills from CareCredit and wound up with a strike on his credit report.

“We are concerned that some health care providers are aggressively marketing these high-interest credit cards to patients without providing appropriate disclosures, protections or refunds,” said Chuck Bell, program director for Consumers Union, which publishes Consumer Reports.

American Dental Association President Ronald Tankersley said the group, after receiving Cuomo’s letter, shares the attorney general’s concern about credit financing practices.

“Financing can greatly benefit patients when it comes to paying for their dental treatment, provided that patients fully understand the terms of the financing program,” Tankersley said.

Phil Hayes, spokesman for the American Society of Plastic Surgeons, said his group had yet to receive the letter. He reserved comment.

Health care providers sent subpoenas include: Allcare Dental Management Inc. of Buffalo; American Laser Centers of Farmington Hills, Mich.; Aspen Dental Management Inc. of East Syracuse; East Syracuse Family Dental Arts; Laser Cosmetica of New York City; Lifestyle Lift of Troy, Mich.; Northern Lights Chiropractic of Watertown; S & Y Diamond Dental P.C. of Brooklyn; Sunshine Dental of Watertown, and Toothsavers of New York City.

June 17 (Bloomberg) — U.S. Senator Richard Durbin, faced with growing opposition and slipping support for his proposal to cap debit-card “swipe” fees, said he is working to exempt prepaid cards governments use to distribute benefits.

“It’s a special-case situation,” the Illinois Democrat and majority whip said yesterday at a hearing on fees federal agencies pay to accept debit and credit cards. “No decisions have been made as to how we’ll address those concerns, but we are working on way to carve out state-issued prepaid cards from the legislation,” Durbin spokesman Max Gleischman said today.

Durbin’s public concession, his first on the debit legislation since the Senate voted 64-33 to approve it last month, followed mounting opposition from card-industry lobbyists and lawmakers who have said that regulating swipe fees, or interchange, will enrich merchants at consumers’ expense.

U.S. Representative Maxine Waters, a lead negotiator for the Congressional Black Caucus on the financial overhaul bill, initially backed merchants in their campaign to regulate the fees, which are set by Visa Inc. and MasterCard Inc. and exceed $40 billion a year. Now, the California Democrat said she’s concerned the plan will hurt credit unions and community banks, which oppose the measure.

Regulating the fees is “a very complicated issue,” Waters said last week in her opening remarks as a member of the conference committee assigned to merge the House and Senate bills. The debate “must be resolved in a manner that doesn’t harm community banks or credit unions but provides some relief to small businesses and merchants, while protecting consumers.”

‘Pleasing Banks’

During an April 28 hearing on a separate interchange bill, Waters said the fees are boosting profits for the biggest lenders while hurting merchants. “The banks are doing everything they can to reap fees from debit-card purchases,” she said. The competition between Visa and MasterCard “has become more about pleasing the banks that actually issue the cards rather than the consumers who use them.”

Waters has been the focus of a lobbying blitz that included a visit last week from hip-hop entrepreneur Russell Simmons, who co-founded the Def Jam rap label, and a June 1 letter from Robert Johnson, America’s first black billionaire. The two, who own stakes in firms that offer prepaid debit cards, said the poor and minorities with limited access to banks may be among the biggest losers if Congress limits swipe fees.

“The Durbin amendment imposes price controls on the fees merchants pay for debit-card acceptance and it threatens to undermine the ability of banks to serve working-class customers who are often shunned by the financial mainstream,” Johnson, the founder of Black Entertainment Television and the chairman of the RLJ Companies, based in Bethesda, Maryland, said in his letter. Waters declined to comment yesterday.

‘Turning Point’

“Her opposition to this would be a real turning point,” said Trish Wexler of the Electronic Payments Coalition, which represents Visa, MasterCard and banks.

Representative Debbie Wasserman Schultz, a member of the House majority’s leadership team, persuaded 130 colleagues, including 70 Democrats, to join her in signing a letter that urges the bipartisan conference committee to strip Durbin’s proposal from the bill.

“If this amendment stands, our constituents will pay more for basic banking products and credit cards and no longer receive valuable services like fraud and identity-theft protection paid for by the current interchange system,” Wasserman Schultz said in a statement.

Editorial Criticism

Durbin also has lost the support of his home state’s largest newspaper. “When Senator Durbin starts picking winners and losers among competing industries, anyone who cares about free enterprise should worry,” the Chicago Tribune said in a June 10 editorial. “The rough-and-tumble fight over interchange fees should be settled in boardrooms, courtrooms and, especially, the marketplace — not by federal fiat.”

Visa and Purchase, New York-based MasterCard, the world’s biggest payment networks, set interchange fees and pass the money to card-issuing banks including JPMorgan Chase & Co., Bank of America Corp. and Citigroup Inc.

Merchants groups including the National Retail Federation, which estimate that U.S. retailers paid $48 billion in interchange fees in 2008, say their members are powerless to negotiate with MasterCard and San Francisco-based Visa, calling them a duopoly. The companies accounted for 91 percent of global purchase transactions made with general-purpose cards last year, according to the Nilson Report, an industry newsletter.

“There is no agency with regulatory authority over the nearly $50 billion collected per year in interchange fees,” Durbin said during yesterday’s hearing. “Nor is there any real competition or negotiation in the market to keep fees in check. Visa and MasterCard set the fee rates as they see fit, and tell merchants to take it or leave it.”

Federal Reserve Role

Durbin’s plan would empower the Federal Reserve to set swipe fees that are “reasonable and proportional” to the cost of processing debit transactions. The fees merchants paid to accept MasterCard and Visa debit cards last year averaged 1.63 percent of each sale, according to the Nilson Report.

The measure also permits retailers to offer discounts based on the form of payment, or for a particular card brand, and set minimums and maximums for credit-card purchases.

Durbin’s decision to exempt governments is a “tacit admission” that his amendment is flawed, according to Wexler of the Electronic Payments Coalition.

“If it would hurt government programs, then that means it would also hurt everyday debit-card holders,” Wexler said. “It is simply not possible to destroy the economics of debit and prepaid card networks and then attempt to shield favored constituencies from the aftershocks.”

–Editors: William Ahearn, Rick Green

To contact the reporters on this story: Peter Eichenbaum in New York at peichenbaum@bloomberg.net; Patrick O’Connor in Washington at poconnor14@bloomberg.net

To contact the editor responsible for this story: Alec McCabe at amccabe@bloomberg.net

InformationWeek
May 22, 2010 12:00 AM (From the May 24, 2010 issue)

Security pros have a love-hate relationship with PCI. On one hand, the standard compels management to invest in security and mandates operational best practices. Failure to toe the line can result in fines and penalties, including increased costs for credit card transactions. Visa, MasterCard, and other card brands could go so far as to revoke a company’s right to process cards, effectively killing the business.

Such consequences get noticed by executives. “We have a security operation because of PCI,” says Bob Kemp, manager of IT security for Sheetz, a chain of gas stations and convenience stores. Sheetz is a Level 1 merchant, which means it processes at least 6 million credit card transactions every year. As such, Sheetz is required by PCI to be assessed by a third-party entity called a Qualified Security Assessor, or QSA, to ensure it complies with the standard.

But on the other hand, security pros also have beefs with the standard. At the top of the list is the notion of safe harbor–or the lack of it. While PCI is mostly sticks, one carrot for merchants is that the card brands can’t fine them if they’re breached, provided the merchants were compliant at the time of the breach. This safe harbor is offered as an incentive to promote compliance. Visa’s Web site includes this statement: “Visa may waive fines in the event of a data compromise if there is no evidence of noncompliance with PCI DSS and Visa rules. To prevent fines a member, merchant, or service provider must maintain full compliance at all times, including at the time of breach.”

The key phrase is “full compliance at all times.” On the surface, that’s reasonable, until you understand that an company is technically compliant only at the time of the assessment. Once the QSA leaves, the company’s status falls into a zone of uncertainty.

How to overcome manual, fragmented ERP budget management

7 Ways To Rein In Spending On SAP

Two technologies–end-to-end encryption and tokenization–may go a long way toward protecting card data and ending this uncertainty. As we’ll discuss in detail in our full report, available free for a limited time at information week.com/analytics/pciupdate, several large card processors offer, or will soon offer, devices that can encrypt card data at the point of sale.

For instance, Merchant Warehouse offers encrypted card readers, which the company says are being used in about 1,000 locations. The system can also return tokens rather than card data to merchants and retailers, which can be used for common transaction requirements such as voiding or refunding a purchase. In 2009, payment processor First Data announced Secure Transaction Management, a service that encrypts card data at the PoS application and sends it to First Data to be decrypted. And Heartland Payment Systems will soon launch E3, a program for point-to-point encryption and tokenization. The processor is offering PoS terminals that have a hardware-based encryption module from Thales.

Shifting liability is a key selling point of end-to-end encryption and tokenization. If these technologies can reduce the scope of PCI and lower the risk of card data being stolen at the retailer’s site, widespread adoption is virtually assured. And that’s good for all of us.

5 AREAS TO VET CRYPTO, TOKEN VENDORS

1. Depth of knowledge:Ensure the vendor can demonstrateits products adhere to PCI guidelines.

2. Level of commitment:You could end up locked in to the payment processor that provides your encryption or tokenization service. Can you live with that?

3. Hard trumps soft:Systems that encrypt card data at the point of swipe using a hardware module are superior to point-of-sale terminals that perform encryption using only software.

4. Ask for assurance:Therearemany potential points of failure.Shoddy key management,places in the processing chain whereencrypted data is decrypted and re-encrypted,caches of clear-text card data outside your boundaries.Get audit results.

5. Don’t get complacent: Adopting end-to-end encryption and tokenization won’t magically make you PCI compliant. Any business process that demands card data in the clear should raise a red flag.

Organizations in specific industries have long been subject to compliance mandates, such as the Payment Card Industry Data Security Standard (PCI DSS) and Health Insurance Portability and Accountability Act (HIPAA), requiring them to protect sensitive data. New data privacy legislation broadens that scope to all businesses that receive, store or have access to PII, which is sometimes defined simply as a person’s name and driver’s license number. Data privacy laws already exist in 46 states and legislation designed to protect PII is currently pending on the federal level. Securing sensitive consumer data has become a required ongoing process, including businesses that do not handle credit card information or other sensitive financial data.

The cost of protecting PII is significant, with businesses that experience a breach often incurring the direct expenses of public notification, additional customer service burdens and credit monitoring for affected consumers. Indirect costs such as brand damage can result in loss of business and deterioration of market value. However, recent industry analyst reports have shown that the implementation of a data protection program can cost less than two percent of the expense of containing a data breach once it has occurred. Trustwave’s Data Privacy Program is the first such data protection offering specifically designed to help organizations protect PII.

“Our compliance engagements and forensic investigations reveal that many organizations do not know where sensitive data is stored within their environment,” says Robert J. McCullen, chairman and CEO of Trustwave. “Trustwave’s program is a comprehensive approach that will help implement key security initiatives to facilitate data management and protect sensitive data to help ensure the business is meeting data privacy regulations.”

The Trustwave Data Privacy Program helps businesses and organizations establish and maintain a compliance program that meets data privacy requirements. To help protect organizations from breach-related expenses, the program offers the following for large and small businesses:

• Assistance in developing applicable security policies for the protection of personal information
• Discovery and classification of personal information stored in the corporate environment
• Encryption of personal information at rest and in transit
• Identification of asset vulnerabilities
• Employee education regarding computer system and personal information security

The Trustwave Data Privacy Program is structured to protect the information handled by all types of businesses and organizations, regardless of the manner in which personal data is stored or transmitted. Key components of Trustwave’s program focus on Physical Data Privacy (PDP) and Electronic Data Privacy (EDP) and include the following options:

• PDP – protects entities that maintain PII physically, but do not store or transmit such information electronically
• EDP Core – protects entities that store PII electronically
• EDP Mobile – protects PII stored electronically on mobile devices
• EDP Transport – protects PII electronically transported over public networks

“I’m proud of our role as pioneers in the evolution of data protection – there’s not another program like this in the marketplace,” says McCullen. “This is really just another demonstration of Trustwave’s commitment to delivering security and compliance solutions that solve real world problems for our customers.”

About Trustwave
Trustwave is the leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today’s challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper® compliance management software and other proprietary security solutions. Trustwave has helped thousands of organizations—ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers—manage compliance and secure their network infrastructure, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, Asia and Australia. For more information, visit https://www.trustwave.com .

Source: Company press release.

]]> http://themerchantserviceinsider.com/2010/05/trustware-delivers-comprehensive-new-data-privacy-program/feed/ 71 http://themerchantserviceinsider.com/2010/05/starr-network-signs-suntrust-to-exclusive-agreement-for-pin-debit-access/ http://themerchantserviceinsider.com/2010/05/starr-network-signs-suntrust-to-exclusive-agreement-for-pin-debit-access/#comments Mon, 03 May 2010 20:32:35 +0000 http://themerchantserviceinsider.com/?p=80 ATLANTA, May 03, 2010 (BUSINESS WIRE) — First Data Corporation today announced that its STAR(R) Network has signed a multi-year agreement with top-ten debit card issuer SunTrust Banks Inc. to provide PIN-secured debit point-of-sale (POS) and ATM access to its cardholders.

Atlanta-based SunTrust is one of the largest banks in the United States, with approximately 1,700 retail branches and 2,800 ATMs across the Southeast and Mid-Atlantic. STAR is one of the nation’s leading electronic funds transfer networks with more than two million retail and ATM locations.

“Our choice of PIN debit network was based on a client-centric approach to decision-making and required an exhaustive evaluation of the leading providers in the market,” said Steve Karp, senior vice president, Enterprise Payments Strategy, for SunTrust. “Throughout that process, STAR demonstrated to SunTrust its unwavering focus on creating value for their members, bringing best-in-class innovation to the market, and leveraging their talented and committed senior leadership team. We believe we’ve selected the best network and long-term partner.”

“This is a huge win for us,” said Kevin Barry, general manager for the STAR Network. “Our new relationship with SunTrust is a validation of our commitment to lead the industry with superior customer service and the most innovative products. SunTrust’s progressive view of payments will be a great match for STAR and our members.”

First Data provides signature debit and credit card processing and production to SunTrust, as well as merchant processing services to the bank’s business and commercial customers. Through the merchant processing alliance, SunTrust can offer a full suite of electronic payment products and services including credit, debit, check, and gift card programs to its business customers throughout the Southeastern United States.

Terms of the agreement remain confidential.

About SunTrust Banks, Inc.

SunTrust Banks, Inc., headquartered in Atlanta, is one of the nation’s largest banking organizations, serving a broad range of consumer, commercial, corporate and institutional clients. As of March 31, 2010, SunTrust had total assets of $171.8 billion and total deposits of $118.7 billion. The Company operates an extensive branch and ATM network throughout the high-growth Southeast and Mid-Atlantic states and a full array of technology-based, 24-hour delivery channels. The Company also serves clients in selected markets nationally. Its primary businesses include deposit, credit, trust and investment services. Through various subsidiaries the Company provides mortgage banking, insurance, brokerage, investment management, equipment leasing and capital markets services. SunTrust’s Internet address is SunTrust.com.

About First Data

First Data powers the global economy by making it easy, fast and secure for people and businesses to buy goods and services using virtually any form of electronic payment. Whether the choice of payment is a gift card, a credit or debit card or a check, First Data securely processes the transaction and harnesses the power of the aggregate data to deliver intelligence and insight for millions of merchant locations and thousands of card issuers in 36 countries. For more information, visit www.firstdata.com.

SOURCE: First Data

Read More http://www.wired.com/threatlevel/2010/03/heartland-sentencing/#ixzz0jxxuZUk8

Take cards anywhere.  Pay lower interest rates on your credit card processing transactions with PAYware Mobile by BankCard USA.

PAYware Mobile is an attachment that hooks  up to your iPhone to allow you to swipe cards wherever you may be.  It’s the complete payment solution that transforms the iPhone into a secure payment portal. With PAYware Mobile, you’ll never miss a sale.  Simply swipe a card, capture a signature and enjoy the convenience of payments wherever and whenever. With PAYware Mobile, not only do you have the ultimate in convenience, you have the ultimate in security. In addition, the app-plus-reader combination can lower your cost of accepting credit cards by 30%.

• Accommodates the many customers who want to use credit cards.
• Encrypts credit card data and reduces fraud and liability.
• Attach to phone, swipe card and capture signature.

If you are interested in having the PAYware for your iPhone, contact a BankCard USA today at: 800.589.8200.