The Payment Card Industry Data Security Standard presents serious legal challenges and risk for retailers.