Yes, PCI QSAs. All they can do, and all the ICO can do, is fine you. A typical fine might be £10k-£100k. For these large businesses, they see it as being more c

Yes, PCI QSAs. All they can do, and all the ICO can do, is fine you. A typical fine might be £10k-£100k. For these large businesses, they see it as being more cost effective to be cavalier about security and pay off the authorities. See amazon's credit card handling, for instance. Like most things in life, it's a two tier system.