Comment by AnthonyMouse

But then "just don't keep the data" is not an effective response to these attacks of requesting someone else's data.