Sorry, I only now got OP‘s intention. I believe it’s somewhat defensible to task only one side here with protecting the data. They have that data all the time,

Sorry, I only now got OP‘s intention. I believe it’s somewhat defensible to task only one side here with protecting the data. They have that data all the time, and it’s therefore more practical for them to explore the legality of such requests. They are also the party entrusted with that data by the customer, and therefore have a fiduciary duty. It also aligns with the idea of those profiting from data to accept liability for its protection. There’s probably also a federal/state law angle here that I’m unqualified to opine on. Also: this is civil law, and therefore nobody was or will be charged (just a pet peeve).