Storing the CVV would be very bad, but the form they’re linking to is ambiguous: “Information Acquired - Name or other personal identifier in combination with:

Storing the CVV would be very bad, but the form they’re linking to is ambiguous: “Information Acquired - Name or other personal identifier in combination with: Financial Account Number or Credit/Debit Card Number (in combination with security code, access code, password or PIN for the account)”