Private Ordering in Light of the Law : Achieving Consumer Protection Through Payment Card Security Measures

This paper, which has been prepared for the conference on Economic Governance and Competition at Tilburg University, examines private ordering within the payment card industry to define appropriate security practices and to monitor compliance by network participants. This private ordering regime has emerged to address the business need for trustworthy systems upon which consumers and merchants could rely. Effectiveness depends on shared economic incentives and reputational sanctions, supplemented by fines and other sanctions imposed through contract by the card brands. Although private ordering has functioned sufficiently well to make payment cards a trusted payment method, the system is not completely secure, as data security breaches have continued to occur. This is not surprising, as complete security is not a feasible goal. Nevertheless, some have questioned whether additional government regulation is necessary to protect consumers. This article explores the effects of legal intervention, including disclosure laws, on this private ordering system. It questions whether additional government intervention would enhance consumer welfare, particularly when consumers are likely to bear the ultimate costs of such regulation. It recommends modifications in breach disclosure laws to eliminate individual notice requirements in favor of public notices, which are likely to reduce costs and enhance consumer welfare, and challenges legislation to reallocate costs from merchants to issuing banks as unlikely to generate significant consumer benefits. Finally, it identifies significant practical and political problems inherent in the different capacities of large and small firms to bear security costs, which are not easily solved under either private or public approaches