"Further, individual merchants or other entities do not have direct access to, and are not provided with, individual credit card numbers or other sensitive or confidential information." . . . .