That's not a correct counter argument, the information he got was understood to be public and there was no reason to expect or think there was any private information on there. If the site had said "This site provides tax returns" then there would be reason to expect the files would contain private information. The site in question gave no indication there would be private information in those files. Also, technical nitpick, there are some countries where tax information is public so probably not the best thing to go with.