I am wondering about the legalities of them doing this. I remember back when we had a merchant account for a retail style business, we were repeatedly warned b

I am wondering about the legalities of them doing this. I remember back when we had a merchant account for a retail style business, we were repeatedly warned by the bank that we were legally on the hook if we took a customer's credit card information and it got somehow compromised or leaked. This was back in the pre-EFTPOS days when a store would have to keep a carbon copy of the customer card imprint (as well as their signature). We were told to guard those slips like gold, and dispose of them properly when not needed any longer, because with that information, we could in effect impersonate the customer elsewhere. I would say that things have changed markedly these days, but I wonder if the legislation, especially here in Australia, has kept up with that, seeing as a customer's login credentials are effectively the same as having their signature which can be copied?