kjlhweopiru

Yes, but then again it's much simpler. Leak credit card data because you didn't stored it as they want, you'll never touch one again. But if you leak personal user data, nothing (really) bad will happen to you.

It's a matter of incentives.

It's funny that there are a tons of requirements before you are allowed to store credit cards (PCI DSS), which are easily changed and expire anyway, yet none for storing ID photo or other highly sensitive personal data, much of which is unchangeable (like date of birth).

As always, the powerful (banks) can rig the system in their favor.