Actually, to 'classify' something is trivial, just a matter of putting the correct words on it.
It just depends on the level of classification how much effort is required to properly apply the classification (e.g. traceability of copies), and what difficulties this brings in handling the documents/software/whatever.
Indeed you can often find innocuous data has some degree of protective marking applied to it because it can be used to infer other details.
And other data can have inappropriate levels of protection applied - people often play safe and put high level marking on stuff that doesn't need it, which causes a cascade of problems for anyone using it (e.g. high level marking on a bit of data, therefore computer the data is copied onto assumes same level, as does attached network etc. etc. and costs/hassle go through the roof, when in fact low or no marking may be appropriate and everything could have been much easier)
'Need to know' is a different concept and more about general protection of data, and applied in most commercial as well as military or other sensitive environments - you shouldn't share information with those who don't need it as you might end up divulging more than you realise, and in any case if you don't need to know, then *you don't need to know*.
As for export controls, they're a joke, and extra broad. And indeed seem to have an impact on commercial activities where 'private' activities are unaffected. e.g. I've been informed that I'd have problems with buying/shipping certain items of computer equipment while I could acquire privately with no problems at all. From eBay. From sources in the 'destination' countries! I'd generally ignore the controls as pointless except the US seems to believe in the global reach of its laws, and they have some interesting ideas about due process.
In this case there has been an over-reaction, particularly given the data didn't seem to be particularly sensitive, or have any kind of protective markings.
This may be down to the authorities realising they were stupid enough to give nationals of an unfriendly power access to their data for years (though for some reason 'friendlies' have all sorts of trouble doing the same), or maybe it's more commercial - they took the data before it could be sold to them, and this has made the original owners a little upset...