There doesn't have to be any bylaw changes, there just needs to be a contract with the customer regarding the usage of their data. One of the old fashioned kin

There doesn't have to be any bylaw changes, there just needs to be a contract with the customer regarding the usage of their data. One of the old fashioned kinds of contracts that doesn't allow one party to make unilateral changes to it. Then if they eventually do sell the data, they invite a class action lawsuit for breach of contract.