If the database contains credit card data then it IS illegal and a serious breach of security.
If its merely a client list, even if it contains name, address, phone, email, demographics and even game preference or spending habits then its not. While we as consumers don’t appreciate retailers or merchants sharing or selling this type of data it’s a very common practice.
When you sign up for anything or make a purchase online (or offline) the prudent thing to do is ask for and inspect the merchants privacy policy. If they don’t have one or duck the issue you can assume they can and will sell or swap your data with other merchants. At that point its your perogative to leave without completing a purchase or providing info you dont want shared.
NEVER assume that a privacy policy is in place or that you are covered under some sort of blanket “law”.