It is illegal, if it's PII without explicit consent.