I feel this is completely legal, though at first it may feel a bit like it's not. It's likely all just values that are randomly generated based on a set of parameters. However, that's just speculation. If it's actually taking bits from actual identities, then there could be a problem.

I believe the biggest issue is the financial section. To make a realistic card number/csv, they open up the chance that they'll get one that actually exists one day. No bueno.