Until&#x2F;unless we can find and implement a workable way to make this a problem Amazon is financially on-the-hook for, instead of Amazon (et al) customers.<p>I wonder what the PCI implications are if it&#x27;s true that Amazon gave away his last four cc digits over the phone?<p>I wonder if there are applicable PII laws in his jurisdiction that&#x27;d have Amazon able to be held liable for disclosing his address? (I think there are here in Australia(1), but that doesn&#x27;t mean regular Amazon customers have any chance of prevailing in court against Amazon&#x27;s in-house legal team...)<p>(1) 6.67 of this says your address is &quot;individually identifying data&quot;: <a href="http:&#x2F;&#x2F;www.alrc.gov.au&#x2F;publications&#x2F;6.%20The%20Privacy%20Act%3A%20Some%20Important%20Definitions&#x2F;what-not-%E2%80%98personal-information%E2%80%99" rel="nofollow">http:&#x2F;&#x2F;www.alrc.gov.au&#x2F;publications&#x2F;6.%20The%20Privacy%20Act...</a>