Even for that there is a due process requirement, contained in E.O. 12333. Obviously the requirements are far lower but even there a random NSA analyst can't simply ask for the data, they'd have to get a supervisor within NSA to approve sending that request outside the agency.

But on the other hand I've not seen evidence that Google simply sells information on specific individuals or otherwise gives it away without that legal mandate.