NRG, an online music retailer, places a cookie on its customers' computers in order to identify customers whenever they log on to the company's website. The cookie allows NRG to maintain a database containing its customers' names, addresses, email information, purchasing histories, and credit card numbers. The technology even allows NRG to track its customers' visits to other websites. NRG analyzes this information internally to make product, inventory, and promotional decisions. 

What would be your first steps in problem-solving this situation?

Should NRG consult their legal team? Why or why not? 

Are there any ethics to consider with this case? If so, what? 

Does NRG need to consult with their public relations department? If so, what should be done?