The bank contended that the company knew or should have known that the equipment would be used to fax, print, or scan documents containing private financial and identifying information, including Social Security numbers, birth dates, medical records, and business data.