You might want to run your responses through your legal and HR departments. You're acting as a representative and ignoring some material claims about a significant data privacy issue. You should probably just delete your reply in fact