The privacy commissioner formed a preliminary opinion that American Express was not protecting its customers from insider threats to their security. Then the credit card company’s lawyers got to work.