It depends on which country you're in, but where I am I would sue the bejeezus out of them if they gave up that information without a full Court order.
In my opinion, that sort of data should only be accessible after an order from the Court, and that in turn should be the result of a police request, not because some private entity has some suspicions. This is not because I expect the police to have higher standards (let's just say that that varies between countries and even counties), but because this is the correct, well established legal pathway that ensures that not every Tom, Dick and Harry can just gain access to such information.
Biting the hand that feeds IT
