If they were publicly available pins, and users agreed to the license that gave them permission to use their data, then they can do that.
I think the broader issue is people being acclimated to permissive licenses, and not having privacy as a default