Yes, just because you can do something with someone's data doesn't mean you should be able to do so.

That this sort of restriction is largely missing from US data laws is one reason we see so much fuss about data centre locations and 'safe harbour' provisions.