yes its legal, but as a merchant, they must ensure they remain PCI DSS compliant and will be audited on it. If they are actually storing the data (they may not be) then they will have a huge questionaire to complete. EastStandWellFan will be able to go into loads more detail as I know he is doing this type of work on PCI compliance at the moment.
The PCI DSS website.