If you are wanting to steal a car then clearly you are commiting theft and the question of data is secondary. Suppose instead your government is wanting to track your car to see where it has been. It is (I hope) illegal for them to force everyone to have a GPS tracker installed on their vehicle for this purpose. However, it is not illegal for a car manufacturer to choose put one on your vehicle - after all you need if for navigation - but then have it record your location data to a file that they can read when they service your car, or even transmit it over a mibile data connection.
Now, in Europe or Canada, data protection laws would probably make it illegal for the car manufacturer to sell that personal data to anyone. However, if they did sell it to say a government then the person breaking the law would be the car manufacturer, not the government, because the data is under the control of the company and they have a duty under the law to protect it which includes not selling it to anyone, government or otherwise.
Hence my question anout what laws the _government_ broke because, from where I'm standing, it looks like the airlines who are at fault here because they owned the data and so it is they who have the duty to protect it although, given the weaker data protection laws in the US, it may be that they are allowed to sell everyone's personal data.