EvilWizard
Member
What is the name of your state?VA
Company is in MD.
This is related to another post I had placed in these forums recently but a bit different. Basically I filed a complaint against a moving company with the BBB and the moving company responded to that complaint by sending copies of my information to the BBB. In this information they sent my Mastercard #, Exp. Date and the CVC2 number. The BBB sent copies back to me to show me what they sent. I reported this to MC International who confirmed that the company is not supposed to store or send that information per PCI standards. I also reported them to the FTC, DoT OIG and etc.... I am meeting with a lawyer next Friday for an initial consultation on what can be done, but here are my two questions I would like clarification on before that meeting if someone here can help.
1. Is sending this information to a third party like the BBB without my permission illegal in Maryland? I did some initial research on this and found the Maryland Code pertaining to this which I put at the bottom of this post.: (Basically for my situation the only thing that would be an exception is if the BBB is considered a Consumer Reporting Agency, but if you look at the definition of Consumer Reporting Agency here Definitions the BBB does not fall within this category IMO.
2. If I am right in thinking that the action by this company is a crime under MD law then should I file a police report before I see the lawyer and bring him copies of the documentation or should I wait for the lawyers input on how the police report should be filled out...?
Thank you in advance if you can provide clarification on this for me.
Maryland Code : CRIMINAL LAW : TITLE 8. FRAUD AND RELATED CRIMES : SUBTITLE 2. CREDIT CARD CRIMES : § 8-212. PART II. CREDIT CARD NUMBER PROTECTION
§ 8-214. Prohibited - Unauthorized use or disclosure.
(a) In general; exceptions.- A person may not use or disclose any credit card number or other payment device number or holder's signature unless:
(1) the person is the holder of the credit card number or payment device number;
(2) the disclosure is made to the holder or issuer of the credit card number or payment device number;
(3) the use or disclosure is:
(i) required under federal or State law;
(ii) at the direction of a governmental unit in accordance with law; or
(iii) in response to the order of a court having jurisdiction to issue the order;
(4) the disclosure is in connection with an authorization, processing, billing, collection, chargeback, insurance collection, fraud prevention, or credit card or payment device recovery that relates to the credit card number or payment device number, an account accessed by the credit card number or payment account number, a debt for which the holder or a person authorized by the holder gave the credit card number or payment device number for purposes of identification, or a debt or obligation arising, alone or in conjunction with another means of payment, from the use of the credit card number or payment device number;
(5) except as provided in subsection (b) of this section, the disclosure is reasonably necessary in connection with:
(i) the sale or pledge, or negotiation of the sale or pledge, of any portion of a business or the assets of a business;
(ii) the management, operation, or other activities involving the internal functioning of the person making the disclosure; or
(iii) the management, operation, or other activities involving disclosures between a corporation and its subsidiaries or controlled affiliates or between the subsidiaries or the controlled affiliates;
(6) the disclosure is made to a consumer reporting agency, as defined in § 14-1201 of the Commercial Law Article;
(7) subject to subsection (d) of this section, whether or not the person is a consumer reporting agency and whether or not the disclosure is a consumer report, the disclosure is made under a circumstance specified in the credit reporting provisions of § 14-1202(3)(i), (ii), (iii), or (iv) of the Commercial Law Article; or
(8) the disclosure is allowed under § 1-303 of the Financial Institutions Article.
(b) Disclosure for marketing against holder's direction.- A disclosure for marketing purposes may not be made if the holder of an active credit card number or payment device number has prohibited the issuer in writing at the issuer's address from using the card or number for marketing purposes.
(c) Notification of nondisclosure option required.-
(1) Notwithstanding subsection (a)(5)(iii) of this section, a disclosure for marketing purposes may not be made if the holder of an active credit card number or payment device number, other than an encoded credit card number or encoded payment device number, has notified the issuer in writing at an address specified by the issuer, that disclosure for marketing purposes is not allowed.
(2) The issuer shall notify each holder of an active credit card number or payment device number of the nondisclosure option and the specified address on a periodic basis at the issuer's discretion at least once each year.
(3) The issuer shall comply with the holder's election within 45 days after receiving the holder's response.
(4) The election shall remain in effect until the holder rescinds the election or until there have been no debits or credits to the credit card number or payment device number for a 12-month period.
(d) Disclosure relating to credit reporting - Requirements.- Notwithstanding subsection (a)(7) of this section, and except as provided in § 14-1202(3)(i) of the Commercial Law Article, a person may not furnish a report containing a credit card number or payment device number before receiving an individual written, electronic, or other tangible record of a certification from the requestor:
(1) containing the reason that the credit card number or payment device number is required; and
(2) stating that the credit card number or payment device number:
(i) cannot be obtained under a circumstance specified under this part or Title 14 of the Commercial Law Article; or
(ii) is needed for security, or loss or fraud prevention purposes.
Company is in MD.
This is related to another post I had placed in these forums recently but a bit different. Basically I filed a complaint against a moving company with the BBB and the moving company responded to that complaint by sending copies of my information to the BBB. In this information they sent my Mastercard #, Exp. Date and the CVC2 number. The BBB sent copies back to me to show me what they sent. I reported this to MC International who confirmed that the company is not supposed to store or send that information per PCI standards. I also reported them to the FTC, DoT OIG and etc.... I am meeting with a lawyer next Friday for an initial consultation on what can be done, but here are my two questions I would like clarification on before that meeting if someone here can help.
1. Is sending this information to a third party like the BBB without my permission illegal in Maryland? I did some initial research on this and found the Maryland Code pertaining to this which I put at the bottom of this post.: (Basically for my situation the only thing that would be an exception is if the BBB is considered a Consumer Reporting Agency, but if you look at the definition of Consumer Reporting Agency here Definitions the BBB does not fall within this category IMO.
2. If I am right in thinking that the action by this company is a crime under MD law then should I file a police report before I see the lawyer and bring him copies of the documentation or should I wait for the lawyers input on how the police report should be filled out...?
Thank you in advance if you can provide clarification on this for me.
Maryland Code : CRIMINAL LAW : TITLE 8. FRAUD AND RELATED CRIMES : SUBTITLE 2. CREDIT CARD CRIMES : § 8-212. PART II. CREDIT CARD NUMBER PROTECTION
§ 8-214. Prohibited - Unauthorized use or disclosure.
(a) In general; exceptions.- A person may not use or disclose any credit card number or other payment device number or holder's signature unless:
(1) the person is the holder of the credit card number or payment device number;
(2) the disclosure is made to the holder or issuer of the credit card number or payment device number;
(3) the use or disclosure is:
(i) required under federal or State law;
(ii) at the direction of a governmental unit in accordance with law; or
(iii) in response to the order of a court having jurisdiction to issue the order;
(4) the disclosure is in connection with an authorization, processing, billing, collection, chargeback, insurance collection, fraud prevention, or credit card or payment device recovery that relates to the credit card number or payment device number, an account accessed by the credit card number or payment account number, a debt for which the holder or a person authorized by the holder gave the credit card number or payment device number for purposes of identification, or a debt or obligation arising, alone or in conjunction with another means of payment, from the use of the credit card number or payment device number;
(5) except as provided in subsection (b) of this section, the disclosure is reasonably necessary in connection with:
(i) the sale or pledge, or negotiation of the sale or pledge, of any portion of a business or the assets of a business;
(ii) the management, operation, or other activities involving the internal functioning of the person making the disclosure; or
(iii) the management, operation, or other activities involving disclosures between a corporation and its subsidiaries or controlled affiliates or between the subsidiaries or the controlled affiliates;
(6) the disclosure is made to a consumer reporting agency, as defined in § 14-1201 of the Commercial Law Article;
(7) subject to subsection (d) of this section, whether or not the person is a consumer reporting agency and whether or not the disclosure is a consumer report, the disclosure is made under a circumstance specified in the credit reporting provisions of § 14-1202(3)(i), (ii), (iii), or (iv) of the Commercial Law Article; or
(8) the disclosure is allowed under § 1-303 of the Financial Institutions Article.
(b) Disclosure for marketing against holder's direction.- A disclosure for marketing purposes may not be made if the holder of an active credit card number or payment device number has prohibited the issuer in writing at the issuer's address from using the card or number for marketing purposes.
(c) Notification of nondisclosure option required.-
(1) Notwithstanding subsection (a)(5)(iii) of this section, a disclosure for marketing purposes may not be made if the holder of an active credit card number or payment device number, other than an encoded credit card number or encoded payment device number, has notified the issuer in writing at an address specified by the issuer, that disclosure for marketing purposes is not allowed.
(2) The issuer shall notify each holder of an active credit card number or payment device number of the nondisclosure option and the specified address on a periodic basis at the issuer's discretion at least once each year.
(3) The issuer shall comply with the holder's election within 45 days after receiving the holder's response.
(4) The election shall remain in effect until the holder rescinds the election or until there have been no debits or credits to the credit card number or payment device number for a 12-month period.
(d) Disclosure relating to credit reporting - Requirements.- Notwithstanding subsection (a)(7) of this section, and except as provided in § 14-1202(3)(i) of the Commercial Law Article, a person may not furnish a report containing a credit card number or payment device number before receiving an individual written, electronic, or other tangible record of a certification from the requestor:
(1) containing the reason that the credit card number or payment device number is required; and
(2) stating that the credit card number or payment device number:
(i) cannot be obtained under a circumstance specified under this part or Title 14 of the Commercial Law Article; or
(ii) is needed for security, or loss or fraud prevention purposes.