I wonder if in part PCI compliance is designed this way as to avoid details or holes in the overall system from creeping up to the surface after years and years

I wonder if in part PCI compliance is designed this way as to avoid details or holes in the overall system from creeping up to the surface after years and years of usage and technologies evolving. I mean, sure, today he's just getting IP addresses, user-agents, and languages, but tomorrow we may be able to harvest something more, and in combination with what was given before, _just_the_credit_card_info on it's own isn't as valuable to an attacker as everything combined. Perhaps in it's own sick way, the rules as absolute is a design that prevents "feature"-creep from pushing its way into the PCI-compliance standards system. Maybe in limited circumstances we could adopt this sort of attitude to prevent feature-creep in other technologies from undermining the original intent of the work. I say this with full respect for the fact that in reality, if somebody tells me to "follow the rules" because "that's how it's done", I'm usually quite upset at their attitude about the whole thing.