The way I understand this, the issue is that without reading it they cannot verify that it doesn’t contain sensitive information, so they can’t give it out. That sounds like a reasonable explanation to me.