xBROKEx, the user in question, has been pretty open in the Reddit thread about the situation. He brings up some very interesting points that are worth consideration.
The danger here is the precedent this sets, where any private company can doxx you no matter how flimsy the conection to their case. Thus making your presumably anonymous free speech a matter of public record. They could do this maliciously for no reason. If they want to use what I typed as evidence that’s up to them, they don’t need my name or address or even testinmony. So the question is why do they need it? Is that a means of retaliation for putting their dumpster fire of a movie on blast? Is it a way to pressure me into saying what they want? Say goodbye to free speech and any form of reasonable expectation to privacy. I used an anonymous screen name so I have that reasonable expectation to privacy right? This opens everyone up and says you have no reasonable expectation of privacy anywhere.
From some of his other posts, it sounds like the Reddit user isn't even the real target of the investigation, but they want his information so that they can sue an ISP that they think he used to pirate the film, I guess because they think the ISP knowingly facilitated the piracy?
The whole situation is kinda bizarre so far.
EDIT: It kind of makes me wonder how such a situation would go down on Lemmy, or elsewhere on the Fediverse. While Reddit can afford to resist film studio lawyers, can Joe Schmoe hosting a rinky-dink Lemmy instance do the same? Chances are that instance operators will be more likely to cave to these sorts of requests, simply because they don't have the resources to fight them. Which I think ultimately highlights the importance of allowing users to easily and readily delete their accounts at will, which most Lemmy instances seem to be doing a pretty good job of, from what I've seen.
Data that has not been overwritten can be recovered. Overwriting the data to counter that would probably be seen as obstruction.
I think a better idea is to do what well run VPNs are doing and not storing personally identifiable information and not saving logs. Courts can't get something that never existed and it saves the instance host legal headaches.