The claim about PCI compliance is false. The requirements for DSS refer to "data at rest", which this absolutely is. You might squeak past your internal audit

The claim about PCI compliance is false. The requirements for DSS refer to "data at rest", which this absolutely is. You might squeak past your internal auditor or a really busy/lazy/cheap external auditor, but it's not going to prevent you from having to accept all liability due to a data breach. It's not as if PCI DSS is trying to prevent someone from stealing your physical media. Please never use this as an excuse to store credit card numbers or track two data in the clear.