There are major differences in the ethical standards of people who sell mailing lists.
I've seen mailing lists that get crazy-high response rates (send 10,000 emails and a few hours later you have $6000 worth of orders for plants).
I have also seen mailing lists that have some addresses that don't even have an @ sign.
Empirically what will get you in trouble is having a list with a high bounce rate. Bounces are a better signal of a bad list because the rate of spam complaints is not very high (compared to the number of people who get spammed) -- many people don't unsubscribe or send complaints because they are afraid it will prove their email is valid and will get them more spam. Other people send spam complaints because they hate you for other reasons.
IANAL, maybe it is legal even in the EU with GDPR but the buyers must get the consent of the data subject before using the addresses. Unfortunately they can't use the addresses to get consent because the data subject doesn't know about them so they shouldn't get the addresses to start with.
It's probably the seller that has to get the consent to transfer the address to that very buyer.
The idea is that the data are owned by the data subject and they lend them to companies. They can ask if they can sub lend to somebody else. It's not polite to lend a borrowed book without asking the owner, right?
I've seen mailing lists that get crazy-high response rates (send 10,000 emails and a few hours later you have $6000 worth of orders for plants).
I have also seen mailing lists that have some addresses that don't even have an @ sign.
Empirically what will get you in trouble is having a list with a high bounce rate. Bounces are a better signal of a bad list because the rate of spam complaints is not very high (compared to the number of people who get spammed) -- many people don't unsubscribe or send complaints because they are afraid it will prove their email is valid and will get them more spam. Other people send spam complaints because they hate you for other reasons.