"The information included names, email addresses, credit card information such as credit card numbers, expiration dates and the three-digit CVV code found on the back of credit cards, although BA has said it did not store CVV numbers."

Is it standard for airlines to handle storing payment card details themselves and hence having to be PCI certified instead of delegating to a PSP?