Absolutely any person, company, or organisation should be liable to prosecution for the movement of anyone's personal data to anyone anywhere else.
No one should be allowed to sell pass or give anyone's personal information to any other person, peoples, companies or any other bodies of any description. The clue is in the word PERSONAL.