Without proof that it was collected legally, purchased data can threaten an enterprise’s security compliance and even expose the company to litigation.
Source: htdarkreading.com