Tactile PIN Debit Keypads required in all stores by 1/1/10.

Several years ago, the California Legislature passed Financial Code 13082, which requires all point-of-sale devices that have a touch screen keypad to also offer a tactile keypad to allow visually impaired individuals to enter their PIN securely. As of January 1, 2010 all retailers must comply with this law, which requires all retailers with more than 2 such devices to equip each one with a tactile keypad, and those with 2 lanes or less to equip one such device.

The actual text of the California law follows.


California Financial Code 13082
Sourced at: http://www.leginfo.ca.gov/calaw.html

(a) Whenever a point-of-sale system is changed or modified to include a video touch screen or any other nontactile keypad, the point-of-sale device that would include the video touch screen or nontactile keypad shall also be equipped with a tactually discernible numerical keypad similar to a telephone keypad containing a raised dot with a dot base diameter between 1.5 millimeters and 1.6 millimeters and a height between 0.6 millimeters and 0.9 millimeters on the number 5 key that enables a visually impaired person to enter his or her own personal identification number or any other personal information necessary to process the transaction in a manner which provides the opportunity for the same degree of privacy input and output available to all individuals.

(b) (1) On or before January 1, 2010, any existing point-of-sale system, except as provided in paragraph (2), that includes a video touch screen or any other nontactile keypad shall also be equipped with a tactually discernable keypad as described in subdivision (a).
(2) At locations equipped with two or less point-of-sale machines, only one point-of-sale machine shall be required to be equipped with a tactually discernible keypad on or before January 1, 2010, as described in subdivision (a).

(c) On and after January 1, 2006, a manufacturer or distributor shall be required to offer for availability touch screen or other nontactile point-of-sale devices to be used and sold in this state that are equipped with tactually discernible keypads as described in subdivision (a) that enable a visually impaired person to enter his or her own personal identification number or any other personal information necessary to process a transaction in a manner that ensures personal privacy of the information being entered.

(d) As used in this section, "point-of-sale device" includes any device used by a customer for the purchase of a good or service where a personal identification number (PIN) is required, but does not include the following: (1) An automated teller machine as defined in subdivision (c) of Section 13020. (2) A point-of-sale device that is equipped to, or exclusively services, motor fuel dispensers. (e) This section shall not be construed to preclude or limit any other existing right or remedy as it pertains to point-of-sale devices and accessibility.

Who is Minding the Legal Risk around PCI?

David J. Navetta, Esq., CIPP, managing member InfoSecCompliance, LLC published an excellent article the April 2009 issue of the ISSA (International Systems Security Association) Journal titled "Who is Minding the Legal Risk around PCI?"

The article reviews the legal framework for PCI related compliance and lawsuits and should be a must read for anyone responsible for PCI compliance for their company.

A PDF of the article can be found here.

Does the Nevada Information Security Law apply to all retailers?

David Navetta has a good post today about the implications of the Nevada Security of Personal Information Law on the InfoSec Compliance Blog.

He makes the point, as have others, that the law applies to almost any company whether you do business in Nevada or not. If you have but one customer from Nevada, even though your stores are not located there, and you accept credit or debit cards from a Nevada resident, then you are required to meet the PCI Data Security Standard and you are required to send the cardholder data in an encrypted format of it is sent outside of your enterprise.