In the EU, that list would be regulated under GDPR. Just as any other list with people on it. You would be allowed to have it, but storing it insecurely or giving people who don't need it access to it would be a violation