I have a question. Are companies required to hold certain information about their customers? Or can a company simply answer a subpoena with "We don't store that information."?
It may be theoretically possible, but it's probably more hassle than it's worth. It's easier for inventory tracking if you have a paper trail (or equivalent on disk). It's also good to have the receipts if you're ever audited.
It's also inconvenient for the 99.999% of customers who aren't trying to cover their tracks, because without the info they wouldn't be able to check their order history.
And it's not simply a matter of telling the law enforcement agency "We don't store that information." You most likely have to jump through the hoops to prove that you don't store the information.
It depends. Some countries have laws creating data retention requirements — in some contexts, for some time periods (with mandatory expiration in the EU), with sharing conditional on some purposes (hopefully for reasons relating to serious crime, but with some laws suspecting or detecting copyright infringement is good enough), with varying degrees of judicial review and oversight of bad-faith requests.
The USA doesn't have a law like that, but it doesn't have a right to privacy either (there is a law about the privacy of correspondence that the NSA and telcos have ignored), so this sort of data retention law is sidestepped by a few large actors “voluntarily” collecting and sharing information. National security letters, gag orders, and whatever power incited AT&T to first do large scale warrantless interception mean that there can be a lot of abuse with little consequences for the participants. This might also apply to smaller actors, although less publicised (I don't know if there's any bad publicity the US government would care about). If you collect it, you might end up sharing it.
For this specific case, they'd probably need to keep that accounting information for filing taxes. I'm not sure about the U.S., but in Canada we need to keep tax-related records for 7 years (I think).
If a company gives that response law enforcement will just come back with a warrant. You might say that's the case. But from their perspective it sounds fishy, and their only way to be sure is to take your servers and find out for themselves.
Usually you're not required to record this in general, but you'd have to convince the police or the judge that you don't have it. If you just sold €1,000,000 worth of goods yesterday, the police might not believe that you (now) know nothing about this person. However if the cops ask for exact details about a €10 sale 15 years ago, you should be able to easily convince them that you no longer store that information.
Lying to the police/courts and obstructing criminal investigation blatently is, obviously, a crime. You shouldn't do it. Also if they get a warrent you are breaking the law by hiding that information.
It seems like it would be difficult to run a business without keeping basic information on your current and past customers. Or are you suggesting lying to the police? That doesn't sound like a good idea at all.
