It wasn't strictly legal to do that under the old Data Protection Act (data could only be used for the purpose declared when it was collected), but I know it went on a lot. There were also certain "loopholes" regarding commercial email addresses (business-to-business messages), so I'm sure many private addresses ended up on "business" lists ("oh sorry, have we used the wrong email address accidentally?").
Now I'm getting emails to my work address from companies neither I or the company has dealt with, asking if I want to continue receiving stuff from them. It will be interesting to see if they stop and the spam tails off over time. I suspect it won't. I've even been spammed (quite a bit) by people selling GDPR services, ironically even though we do that ourselves (the selling of GDPR services, not the spamming!).