It's not just a legal action that a company has to think about. Getting caught into a case of someone dying or being hurt because your company wasn't prompt to

It's not just a legal action that a company has to think about. Getting caught into a case of someone dying or being hurt because your company wasn't prompt to assist police could be a huge PR screwup, even if there's no legal responsibility. And it doesn't have to even be a decision on a company level, ordinary people are strongly inclined to follow the police requests and see them as an authority, so employees of the company will feel as their duty to provide the data promptly. Just look on all those cases of pranksters posing as police officers and making ordinary people do insane and even clearly illegal things just because they were "ordered so by the police". Compared to what that McDonalds manager did [1], pulling some personal data from the database and emailing it back to the person one believes is a police officer is nothing. [1] https://en.wikipedia.org/wiki/Strip_search_phone_call_scam https://en.wikipedia.org/wiki/Strip_search_phone_call_scam