If a vendor clearly ignores PCI-DSS regulations and puts my personal credit card information at risk, is there any legal action I can take against them?
In the case at hand, a vendor first scanned my hand-written order form with a phone (likely a personal smartphone) and then sent that scan to me in an unencrypted email. But this is not the first case in which a vendor has mistreated my information like this.
While I have not (yet) incurred any actual damage, I would like to be able to do my part in making vendors aware of their obligations. So far I usually send a nice email reminding them of the PCI-DSS regulations. But I always feel like that these emails are ignored at best. Is there some form of cease and desist that I can apply in this case? Is there a place or organization that I should notify? Should I sue them?