"Requests may ask for data about a number of different users or just one user. A single request may ask for several types of data but be valid only for one type and not for another; in those cases, we disclose only the information we believe we are legally required to share."