Very good question which does not refer to a specific country but to all of the corporations local and global alike, for the legality would depend on the governmental framework that is place that would guide through what is legal and what not and for ethical practices would be too broad to assume as by its core definition the ethics only stipulate the understanding of what is right and what is wrong which for some maybe right but others wrong,

I would add to your question, what are the purposes of the data collection and its use? is there a component where the customers have the right to not disclose the information and how would this impact on the "corporate advantage" in the region and more broadly, globally

Mostly on ethical and legality require both stick and carrot. However, it depend on the awareness of the intrinsic value of the organisation which rarely being discussed today, even at global scale more or so in Malaysia.

Generally in business, tort law is among the legal framework being applied, but depending on the context of business, require different set of law.

Sometimes when people talk about competitive intelligence (CI) gathering they use terms like “spying” that can feel legally and ethically iffy. In actuality, most competitive intelligence strategies are a normal and expected part of running a business thoughtfully. But some cross a line into territory that could get you into legal hot water.

To avoid that, you need to understand the legality of competitive intelligence strategies—what kind of information gathering practices are OK, and which to avoid.