They do have the capability to not have the data requested. If they are not required by law(and it seems they aren't), why store any data? They may have to provide data of the sessions that are active right now but it's unlikely.