Actually, legally, they sort of have to give up the data. They are taking a risk not handing over the data, thankfully it's the right risk to take. The law is malleable for a reason; laws often become outdated.

Business wise they should to do this, yes, but that still doesn't mean it's an easy "they sort of have to" situation.