The obligations that PCI DSS compliance places on organisations taking card payments are very clear: it is a breach of PCI DSS for any organisation to retain sensitive authentication data, in any format, whether encrypted…