I think this is obviously bad. I believe in Europe is just flatly illegal under GDPR? I would expect this to be illegal everywhere (if it was private information like medical records etc.) but I'm not a lawyer.