To give them the benefit of the doubt:
* Do you consider this diagnostic data to be highly personal, worth protecting heavily? (Does it include GPS?)
* Do you trust your engineers to properly verify the identity of a person before granting this potentially highly personal data?
* Does your legal department trust your engineers that much?
* Do you have the resources/desire to lay out a foundational system of getting that identity verification and granting that data?
If you answered "No" to any of those questions, you might very well want to say "We will do it if it is required of us by a court order."
While it is unideal, it's not nonsensical.
To give them the benefit of the doubt:
* Do you consider this diagnostic data to be highly personal, worth protecting heavily? (Does it include GPS?)
* Do you trust your engineers to properly verify the identity of a person before granting this potentially highly personal data?
* Does your legal department trust your engineers that much?
* Do you have the resources/desire to lay out a foundational system of getting that identity verification and granting that data?
If you answered "No" to any of those questions, you might very well want to say "We will do it if it is required of us by a court order."
While it is unideal, it's not nonsensical.