SB439-SA2,1,6
3"
(2) Retention of certain information prohibited. (a) No person that accepts
4an account access device in connection with a sale of goods or services may retain for
5more than 48 hours after the sale is authorized any of the following obtained from
6the account access device:
SB439-SA2,1,88
2. A personal identification number.
SB439-SA2,1,99
3. The full contents of a magnetic stripe on the access device.
SB439-SA2,1,1210
(b) No service provider may retain any of the following obtained from an
11account access device in connection with a sale of goods or services after the sale is
12authorized:
SB439-SA2,2,1
12. A personal identification number.
SB439-SA2,2,22
3. The full contents of a magnetic stripe on the access device.".