The Payment Card Industry Data Security Standard forces merchants who want to work with Visa/MasterCard/etc to have a firewall, encrypt passwords, send card numbers over HTTPS, etc.
Is there a database of PCI-DSS violations, to which anyone can send reports?
When trying to order a ticket from an airline's official website, I have randomly noticed that they send credit card numbers over HTTP. I tried contacting them but they don't seem to care.
That company is based in a non-democratic country that does not have anything like ico.org.uk.