They should not only be banning the buying and selling of this data, but any type of sharing as well. You may only share this information with another party with the permission of a judge.