This is page 2 of:
Macy’s Ignores Govt. Subpoena For CRM Records In Lead-Tainted Necklace Criminal Case
Wright said his office wants the names of those who bought the products mainly so that they can be warned. He noted that Pecoware, the Chino-based company that imported the jewelry from China, has been much more cooperative than has Macy’s even though it, too, faces fines if convicted. A voluntary recall of the necklaces, in which buyers were urged to contact Pecoware for a refund, was issued in February by the U.S. Consumer Product Safety Commission.
Officials said that, between January 2006 and November 2007, about 2,900 of the necklaces were sold and they contend Macy’s sold more than any other retailer.
Wright said Macy’s has offered no explanation to him for its refusal to cooperate. However, he said he doesn’t think the company is keeping quiet due to fear of violating the privacy rights of its customers. “I don’t think it has anything to do with that,” said the prosecutor. “I just think they don’t want to give out the information because they are afraid they are going to be sued by the people who bought the products. They never explained it. I’ve been asking for it for so long. I know they must know something like names, addresses and phone numbers.”
Wright said he asked Macy’s to notify the customers first, before providing the information to his office. “I know every product has a SKU code and people have to be billed if they buy it with credit card although the cash sales are impossible to track. I also know that a large number were purchased with Macy’s cards and they would be extremely easy to track.”
Wright said litigants in civil cases often have the right to refuse revealing customer information. However, that shield does not apply in California to criminal matters. He noted Macy’s, as of Tuesday, April 1, hadn’t even filed a motion to quash the subpoena and he’s hoping the company will bring the information to the April 7 hearing.
April 2nd, 2009 at 7:57 am
Given that all companies, esp ones of the stature of Macey’s, are required to be PCI compliant, I would put forth another reason that they may not be able to produce the info that the Attorney general wanted: masked CC# or that they do not even have any of the CC# stored at all.
Another more sinister reason may be that they are still not PCI compliant and are storing all CC# in plain text? This would be a good reason to NOT hand over their CRM (strictly coming from a PCI perspective).