The key here is that the data is obtained via a 3rd party. Once you as an individual share any information with a 3rd party you lose any expectation of privacy. In the digital world there are specific carve outs for email, but not much else.

These actions are terrible, but completely legal.