In the edge case that it wasn't Nine PBS requesting the Nine PBS data, you've now opened your company to a huge can of worms. Only OSS knows who Nine PBS is in their database, hence why, from a liability standpoint, it makes sense to say it's OSS's problem.

Also your storage company case is actually it's own can of worms, see the Lego drama from a couple months ago about that. It seems obvious, but in the eyes of the law there's more paperwork than you'd think.