Unless he is a government, insurance, credit card, bank, real estate organization he should not be asking for a SSN online or storing it unless they are for his employees or the transactions being conducted requires notification to the IRS or the transaction is subject to the customer identification program rules. Either way PII like this should be securely stored offline.

For Credit Card information it has to all be transmitted and stored in an securely in accordance to the credit card merchant agreement he has agreed too.

The HTTP protocol is not secure, when your family member is hacked or audited they may be liable for many civil and criminal charges.

Have them read all the information for PCI DSS compliance - https://www.pcisecuritystandards.org/merchants/

You have done your part by advising him about the risks, privacy concerns and how bad it really is. Either way it is ultimately a risk he is accepting for himself and the business which he will have to deal with the consequences when something bad occurs in the future.

If he needs proof of how bad the decisions he has made can be, point him to many of the recent credit card and government organization breaches.