Outside of advertising, are their legitimate reasons to sell or trade customer information to a vendor that does not directly support the operation of your busi

Outside of advertising, are their legitimate reasons to sell or trade customer information to a vendor that does not directly support the operation of your business (i.e. subcontracting work that may require customer details). In the US HIPAA is the closest thing we have, but it would be nice to have a blanket law that says data between two parties cannot be shared with a third party, full stop, regardless of consent. I think having a straight forward transactional pay or you get nothing model levels the field in a way that back door deals with data brokers could ever match.