They could have sent the information without PII That could put it within the realm of legal, but without PII, I don't know how you use the data to do what it seemed he wanted to do.