A new case could set precedence for a merchant community often overwhelmed by the burden of PCI compliance.