Selling citizens’ personal information would likely violate several core principles of data protection, including purpose limitation, fairness and lawful processing.