The issue focused on whether the company could be held liable if customers used stolen credit or debit cards, or other forms of identification that have been linked to identity theft.

It was the first court case to be brought under the new rules, which require companies to provide "identity information" to government agencies, including law agencies, in an investigation into data breach.

The new rules will also require companies to report data breaches to law enforcement authorities when there is sufficient information to determine whether the data was used