The person you replied to didn't state that the data is already being sold, however a quick Google search reveals concrete examples of this already being the case in the UK, which has relatively strong privacy protections: http://www.guardian.co.uk/business/2005/sep/20/freedomofinfo...