It would be much easier just to mandate that storing customer info is not allowed as a company.