I think they are trying to downplay the data protection aspect of this and that's why they used Copyright law rather than DP law when asking Null to take it down. It's not just the US DP laws they have to deal with but GDPR and other international DP laws, most of which have been updated to be quite similar to GDPR since 2018. They didn't act when they were first notified and haven't been able to secure the data either which makes it messy. There are very few home addresses and personal phone numbers on the spread sheet though, it is mostly business addresses and business email addresses and phone numbers, this wouldn't have been such a big deal if they had of acted when they were first notified.