It's the same thing for medical data. Hospitals can't sell your medical data in the US but if you google stuff or engage with media that tells you have a medical condition... that's fine. So much so that they will sell data that includes who is pregnant or has diabetes and such.
Honestly I don't see why buying data on the open market is illegal. I think it shouldn't be legal to sell it but it is. I'd prefer nobody have access than the NSA pretend they don't see what anyone else can buy.