It depends on the contract (sometimes called the Terms of Use or End User License Agreement) that the customer signed and agreed to. If that agreement (which is a binding contract) says that the company can sell information given to them, it is perfectly legal. If the contract says that the company cannot sell customer information, then doing so would be a breach of contract.