Imagine the policy scans you computer and it contains dozen of valid CC numbers, or something that links to that.

You'd be in troubles. Thus I'd say, while it may or may not be illegal - it's probably a bad idea to get and store that stuff.