Nobody is auditing nor policing those GDPR SAR responses, so there's little reason to be truthful. The most likely explanation is, short of actual malfeasance,

Nobody is auditing nor policing those GDPR SAR responses, so there's little reason to be truthful. The most likely explanation is, short of actual malfeasance, that the ticket of "include transaction data or data derived from it into GDPR data exports" is rotting in the Jira backlog to this day.