We have a user who is being harassed by somebody and on our service, the harasser filled out the user's password reset form.
This created a log entry that essentially says
<Harasser's IP address> initiated a password reset for <User's Username>. Instructions were mailed to <User's Full email address>.
We would like to provide this data to the user who is being harassed so they can pursue it with the internet provider to see if they can figure out who is harassing them.
However, we're unsure if this data is considered somebody else's PII, and thus we cannot give out this information.
Would the harasser have a case against us for giving out their IP address to the user they are harassing?