I'm Canadian so obviously our privacy laws will be different but when I worked at a Telecomm we were told that in order to be compliant with the law we could only use customer data for what they has explicitly agreed to. Any changes to what we want we need to have them approve it again.