The "Chinese values" excuse doesn't fly. We're not talking about a random Chinese person, we're talking about a Debian packager. Debian packagers should have values in line with the Debian project's ethos. It's difficult to imagine how somebody to whom Debian's values are alien could even accidentally stumble their way into the position of being a Debian packager.

If that was an acceptable response we shouldn't accept people from those cultures into positions where they can affect our privacy. Or we can just stop using "cultural differences" as a bludgeon to whitewash bad behavior.