Not if they're bound by contract OR if they conspired with someone who was. In other cases, yes. But what we think of whether it's "fine" or not is irrelevant: it'll happen anyway (try looking for Norton source code on TPB). What it matters is whether we want to fund laws to fight windmills.

And for that matter, why should there be information security laws if there's no intellectual property?

There are many laws under that "banner". What laws do you mean?

If you mean Data Protection, those are essentially mandatory contract terms. Regardless of whether they should exist or not, they're very different, because you're only bound by them if you enter in a contract (implied or not) with the person or company providing you with the data.

Whether that data is "property" or not is irrelevant.