customer data protection tobacco