...and you are 100% sure that if this got before a court, the decision would go your way?
I did some reasearch though, and indeed there seems to be an untried case where, if it is obvious that the owner of the data wants to keep it secret, it isn't okay. It is in danish so you'll likely need som google translate or somesuch, search for URL hacking: https://projekter.aau.dk/projekter/files/305754822/Speciale_...
But as a rule, it is on par with an email sent to a wrong recipient. https://www.version2.dk/artikel/lovraad-slaar-fast-url-hacki...