How would that happen? Companies don't have to provide all data stored about users if they have valid reasons not to do so. If certain elements could expose IP,

How would that happen? Companies don't have to provide all data stored about users if they have valid reasons not to do so. If certain elements could expose IP, this should be a valid reason. And most data can be reformatted to not expose any internal structures. It's honestly the first case where I heard that and I've been working with companies to become compliant since the start of the year (many still struggle to be fully compliant). Could you elaborate a bit?