I know that if this was the Uk though, you would legally have to honour this request under the DPA, but i think the USA is different
What? I don't think so. I may be wrong but I can't be bothered to look it up.
What I do know is:
- The Data Protection Act is grossly misunderstood in the UK.
- You are obliged to provide what you have on record when requested by it's owner.
- You can be penalized for having inaccurate data / failing to provide it on request in a timely manner and not taking reasonable precautions to protect it.
- You can't give that data to any third party other than a government official with a legal warrent, or express permission of the owner.