Lily,
I researched this for a client once. I checked the CAN Spam Laws and it is not illegal to send unsolicited email.
What is required in that unsolicited email is to give the name and address of the sender and a way to OPT-out of the email list.
The Spam Law made more work for people who had to opt-out of lists it was termed the 'I CAN spam' law.
Anyway, you can use those email addresses to send email. It is often frowned upon, though because people just don't like to receive unsolicited email.
If your boss wants to send out an email to these recipients, I would make it an email which explains that he had met them at some time and received their business card. I would explain that he would like to add them to his newsletter list and give them a good reason to do so but only if they opt in. Anyone who does not opt-in I would consider a bum lead and not pursue them any further.
So the answer is yes, you can legitimately send out email from that database.
Here's a link to the law itself.
http://business.ftc.gov/documents/bu...guide-business
Janine