If the request is done in the context of GDPR, you cannot withhold data you have on a person. It is a person's right to know what you are gathering about this person and a request of that nature should be satisfied in full.
I have dealt with this since 2028 when GDPR became a law. A good tactic is to publish in the help files or T&C which fields you are actually collecting and for which purpose they are used.
It usually leads to an internal debate about needs and necessities.
