PCI isn't law, it's the product of an industry group, and is arguably more about the protection of the networks and issuers than consumers. There is even less

PCI isn't law, it's the product of an industry group, and is arguably more about the protection of the networks and issuers than consumers. There is even less guidance and specific regulation pertaining to the encryption and security of banking records. The audits and regulations that are in place are more about overall controls than technological measures.