I'd go so far as to argue that the 4th amendment ought to be amended to apply to such data. Such customer records may have been sensitive in the past, but they've become far more personal and all encompassing.