In our privacy policy page we did mention that third parties may have access to your information.
is this even possible? how much we should charge per email blast?
It's 100% possible since the emails are in your hand. If the policy was third parties may have access of the information then you are okay to go. However in normal case a subscriber is interested to the product or service you offered and gave you their details for that reason. They did not gave the details to receive spam in their inbox.
It's sad but usually users don't read privacy policy page and just stick mark to continue registration, yeah, that's their fault but you can't write anything you wish. How can you offer such privacy policy when it's against laws? So from this, you violate laws, you try to agree users on what's prohibited. Second law violate will be if you sell their data, in overall we have two violate from you so I think you have to change privacy policy and forget selling of their data, at least that's unethical man.