Security rules are wonderful things and nowhere are they more needed than in retail and payment card data. But there is a common criticism of the organization that handles such matters.