[pmontra]

IANAL, maybe it is legal even in the EU with GDPR but the buyers must get the consent of the data subject before using the addresses. Unfortunately they can't use the addresses to get consent because the data subject doesn't know about them so they shouldn't get the addresses to start with.

It's probably the seller that has to get the consent to transfer the address to that very buyer.

The idea is that the data are owned by the data subject and they lend them to companies. They can ask if they can sub lend to somebody else. It's not polite to lend a borrowed book without asking the owner, right?