The person you replied to didn't state that the data is already being sold, however a quick Google search reveals concrete examples of this already being the case in the UK, which has relatively strong privacy protections: http://www.guardian.co.uk/business/2005/sep/20/freedomofinfo...
Multi-billion dollar company that does nothing but buy and sell that kind of data. They have categories of information about people that only the government is allowed to access.
