I think the preamble to the legislation sort of goes over it. I remember a section talking about marketing and it seemed to imply that businesses have a legitimate interest to market their own products to their own customers. For example, a Dutch company might look at address data and see that they get a lot of orders online to ship to Germany and they can use that to open a store there. Obviously the business is interested in selling to its consumers effectively and obviously those consumers are interested in those products. When they start selling that information to other people, it isn't really legitimate anymore.