The story does not end here there is a big press on from the industry trade association and legislatures, to pass a federal law about breach and security notification. Plastic Card Security Act In 2007, “Plastic Card Security Act” was established in Minnesota which stated that if a company is breached and later on it is discovered that the company was storing prohibited PCI data like CVV codes, magnetic stripe, track data etc.
then it is required to repay banks and other individuals costs linked with reissuing and blocking of cards. According to this law such companies are open to private lawsuits. The law at the moment is not to be implemented on Level 4 merchants (carrying out less than 20,000 card transactions per year).