Whether this is legal or not legal depends entirely on the contract.
Whether it is ethical, in my mind, depends on why this particular person was given the contract. When you hire a business, there is some expectation that the business will hire or subcontract who it needs to perform the work but will do the due diligence to make sure the work is properly completed according to the contract terms.
When you hire an individual, it is more likely based on the skills that particular person brings to the table and thus it seems more like a bait and switch if he contracts out the work especially without letting the client know he is doing so (who is not his boss BTW if he is a contract worker but his customer).
Further giving unauthorized people access to even anonymized data is a bad thing. The structure of the database is also generally proprietary information. The business has a need to know who has access to the database and the right to limit it to only people they have approved of. Doing this without letting the company know is almost certainly unethical and depending on the nature of the database could open him to a lawsuit or to losing the business if they found out.
Further, he is responsible for the work. If he is too lazy to do the work, what are the odds he is properly checking it? What are the odds that the unofficial subcontractors are going to misinterpret the requirements when they have no access to the people who can answer their questions? What are the odds that the type of devs who can be hired at such little pay that he can make a profit on an individual contract are in fact going to produce work that is good enough?
In this case, he may well produce such bad work that he will lose not only this contract but his professional reputation which could result in a much reduced ability to get new contracts. And this is actually what he deserves for losing track of ethical behavior in the first place.
I missed earlier that his a a data entry clerk doing piecemeal work. I want to point out that for him to outsource the data entry, he would have to be providing his log in credentials to the workers he has hired and thus is giving them direct access to the company network. This is almost certainly unethical and may cause legal issues if someone uses that access to break into the company network.
If there is a data breach and it is traced to his login, then he could be in serious hot water as most people who are given access to a company network are required to protect that access and often sign something stating they will not provide their login to anyone else. And even if they don't catch him for providing his login, he might have to take the fall for committing the data breach even if it was one of his "helpers" who did it.