Antitrust Law Daily Wrap Up, ANTITRUST NEWS: Retailers ask FTC to investigate credit card industry group that sets data security standards, (Jun 3, 2016)

By Linda O’Brien, J.D., LL.M.

The Payment Card Industry Security Standards Council (PCI) is a proprietary organization formed and controlled by the major credit card networks and fails to meet any of the principles adopted by the federal government for voluntary standard-setting organizations that are intended to promote reasonable data security standards, retail trade association National Retail Federation (NRF) has alleged in a letter to FTC Chairwoman Edith Ramirez and Commissioner Terrell McSweeny. Thus, the FTC is urged to conduct an investigation into the PCI’s processes and practices to determine if they violate antitrust laws.

The association acknowledges that the FTC Bureau of Consumer Protection has launched an inquiry into how certain companies conduct assessments of business compliance with Payment Card Industry Data Security Standards (PCI DSS) and believes that the FTC may be considering PCI DSS as indicia of the industry’s best practices and reasonable data security standards.

In a white paper submitted with the letter to the FTC that details the NRF’s standard-setting and competition policy concerns, the NRF notes that the PCI council was formed in 2006 by the major credit card companies—Visa, MasterCard, American Express, Discover and JCB. It imposes its rules on millions of U.S. businesses but continues to be governed by an executive committee made up of representatives of only those five companies.

The card companies use their market power to "unfairly leverage their brands and proprietary technology through webs of closely controlled interdependent bodies and compliance regimes" including the council, the paper claims. While portrayed as voluntary, the Payment Card Industry Data Security Standard requirements set by the council are "forced upon businesses that cannot refuse to accept credit and debit cards."

The council’s practices raise antitrust concerns for several reasons, including "general antitrust dangers when competitors collaborate on setting market standards" and "more targeted concerns insofar as they allow the networks to leverage their proprietary technology." Among other concerns, PCI requirements act as "as an anticompetitive barrier to innovation" because they "exhaust" funds and other resources retailers have available for data security, the paper states.

NRF asks that the FTC investigate the council’s practices in general and particularly their impact on competition. The FTC also should reject government use of PCI standards as any benchmark for data security, and instead work with "legitimate U.S. standard setting bodies," such as the American National Standards Institute, to ensure that standards for the payment card industry and card security are set in a manner consistent with the U.S. Standards Strategy and competition policy, NRF says.

"We urge the FTC not to rely on PCI DSS for any purpose, particularly not as an example of industry best practices nor as a benchmark in determining what may constitute responsible data security standards in the payment system or any other sector," said NRF Senior Vice President and General Counsel Mallory Duncan.

Companies: National Retail Federation; Payment Card Industry Security Standards Council

News: Antitrust ConsumerProtection Privacy FederalTradeCommissionNews