[kvdveer]

Under current law, you cannot be compelled to share more data than you're already collecting. However, the term "collecting" is a bit wider than the most common use. If you receive some piece of data, you are collecting it, even if you don't keep logs, or don't do anything with it.

It's not much different than how detective work is done in the physical domain. You cannot be compelled to ask a customer for more info, but you can be compelled to share info that the customer gave to you, even if you didn't ask for it or never wrote it down.