[prepend]

In some situations data can not be sold if the privacy policy only allows internal use. For example, gmail doesn’t allow my mail to be sold or loaned to anyone, but google can access the data to show ads and for quality control. (See https://www.google.com/policies/privacy/#infouse)

Google is unlikely to be purchased. But if the NSA bought google, then it could use my gmail data -per the privacy agreement that I agreed to- “services to provide, maintain, protect and improve them, to develop new ones, and to protect Google and our users. We also use this information to offer you tailored content.”

This is only possible if the organization is purchased.