Revised carding policy criticized for retaining data