Had the author not notified the city that they had royally screwed up by divulging far more sensitive information than they had realized, they likely would have never realized the error, and he would have been free to do whatever he liked with the data.
But once he notified them of their error, and they realized that the data was now in the hands of someone who should not have been given access to it, there is an interesting legal question about whether he has the right to keep it.
If this were physical property, or money, then there is a lot of case law around what happens when you find yourself in possession of something that was given to you by what was clearly a mistake. If a car dealer accidentally drops off a new car at your address, but later realizes it was intended for another address, you don't get to keep the car. Likewise, if $100,000 shows up in your bank account because it was mistakenly deposited there, that's gonna get clawed back.
But what about data? Mere information? I think there is a pretty good legal argument that there are categories of data (e.g. trade secrets) that a person can be ordered not to possess. So I think the author made the right call by agreeing to cooperate with the city's request, even if it was the city's own colossal error that put him in that position.
Nevertheless, it would have been nice for the city to reward him for his bringing the issue to their attention, rather than immediately trying to threaten him if they didn't help clean up their mess.