PCI does “cost” enough. Remember that the £500,000 is only for violation of the operating regulations from one card brand. The real cost for larger merchants can be see in the multiples.

I don’t really think the multiples make a difference to the larger retailers (even if they do know about them), when the cost is such a small margin of their operating profit. When companies like Tesco are turning in £2.2bn a year, £3 million suddenly looks very small.
However, they are in a pretty tight market space where every little thing counts, even down to moving where the goods are placed in the shop. With their competitors announcing schemes to win back market share (”Making Sainsbury’s great again” - hmm) they need to do everything they can to protect their brand reputation.
I’m not saying that PCI can’t affect them, I wouldn’t be here if it didn’t, but hitting the brand is a far more effective way of making them comply and in turn promoting security.

[...] Newby writes on PCI Compliance Demystified, writes “PCI in Europe is a case in point for the weight of reputational damage in driving [...]

I agree this is a good debate, and one that will ultimately decide the fate of compliance for super-stores like Tesco (UK) and Walmart (USA). Sure the increased size of the store increases their risk (i.e. more credit cards stored so a loss would be much greater) but until a large compromise happens there is no way to know if this philosophy really holds up.

TJX was a wake up call for many US based merchants. It may take such a compromise in the UK for merchants there to take serious notice of their risk.

TJX was a classic case of getting it wrong and ignoring it even when warned. They really deserved to be fined, and to get the ensuing reputational bashing. You’re right, a big event like in the UK that would show why security matters, and that we don’t just push PCI because it’s fun. The UK has always had the classic “shutting the stable door after the horse has bolted” approach to security.
The thing which TJX also proves is at the moment, there is no such thing as perfect security. PCI pushes for strong policies, regular vulnerability testing, avoiding pitfalls like default passwords, and these are some of the most sensible things you can do in any security environment, but we still haven’t fixed everything with technology either.
Whichever way it eventually goes, I would rather these guys learned about PCI by being threatened with disclosure than by actually having to disclose something.

Article on “Brussels-inspired laws are passed, paving way for steps to cut fraud : Germany leads EU on disclosure rules”

Germany has become the first European Union country to pass more stringent, Brussels-inspired laws on financial disclosure, paving the way for wider adoption of regulations designed to curtail fraud in the financial industry

[...] is slowly sinking in the affect SEPA (Single Euro Payments Area) will have on the PCI DSS market.  In a post that Rob mentioned in March (PCI awareness month) he hinted at something the card associations have [...]