Prohibiting the sale of individually identifiable information is a very weak protection. It's alarming how quickly multiple dimensions of "anonymized" data can be used to zero in on any target person, and it won't take long for amoral opportunists to start selling de-anonymized data to the highest bidder. See also k-anonymity.