Neither credit card numbers nor IP addresses were included because we don’t retain that information for our own protection as an organization. In general, you

Neither credit card numbers nor IP addresses were included because we don’t retain that information for our own protection as an organization. In general, you can not be compelled to produce something which you do not have. This is why you see legislation proposed with mandatory retention policies for various businesses.