Data requests show cities can't keep email addresses private