Yep, but it's not legal. At least not in the UK
You get rogue employees even rogue companies that just break the GPDR rules to make a quick buck and of course you get hackers who gain access to company databases.
Also be careful about submitting your details to any apparently free (or even paid entry) competitions as the T's and C's are often interpretable as allowing the submitted details to be used as the recipients see fit.