There is all kinds of pressure on the company to listen to what the financial regulator says, to what the Privacy Commissioner says, and for reputational reasons, etc. But ultimately, under the current rules, it would be the decision of the company.
On February 1st, 2007. See this statement in context.