Hacker News Reader

Not a law, its an industry standard. Its enforced by the card companies (Visa, etc) but generally only if you are processing enough transactions.

Ahh, I was mistaken. I thought that you could be hit with fines if you don't comply with PCI.

(This is why I always use a payment gateway and never keep details myself.)

Yeah, you can be fined, audited, have your merchant account revoked - all sorts of badness.