So 3.1 is all about not keeping it if you don't need it; 3.2 is
a weird one because now it's saying well,
don't keep sensitive authentication data.
Right.
And that's pretty self-explanatory, isn't it?
Right.
Do you have merchants or clients where that's a
problem for you where they think oh, I'll keep this or I'll keep that?
Well, at the risk of sort of tip-toeing over the brink of call recordings,
that's the most obvious case, right?
Where you've recorded the CVV2 as part of the MOTO transaction?
Right.
That's the most obvious case.
Other cases, at least for merchants, any longer,
I don't find that to be particularly common,
and even for service providers,
I don't find that to be particularly common unless the
entity is involved in card issuing,
in which case there's kind of a pass for that.
Yeah, there is a pass for that.
But you know,
I used to see that a lot in e-commerce where people would
keep the PAN and the CVV2 together.
Yes, once upon a time.
I think that's gone now, really.
By and large, yes.