Such things can be subjective and there are some interesting and various solid arguments on both sides. However [in my opinion] returning a 404 for missing data is not correct. Here's a simplified description to make this clear:
Nothing broke, the endpoint was found, and the table and columns were found so the DB queried and data was "successfully" returned!
Now - whether that "successful response" has data or not does not matter, you asked for a response of "potential" data and that response with "potential" data was fulfilled. Null, empty etc is valid data.
200 just means whatever request we did was successful. I'm requesting data, nothing went wrong with HTTP/REST, and as data (albeit empty) was returned my "request for data" was successful.
Return a 200 and let the requester deal with empty data as each specific scenario warrants it!
Consider this example:
This data being empty is entirely valid. It means that user has no infractions. This is a 200 as it's all valid, as then I can do:
You have no infractions, have a blueberry muffin!
If you deem this a 404 what are you stating? The user's infractions couldn't be found? Now, grammatically that is correct, but it's just not correct in REST world were the success or failure is about the request. The "infraction" data for this user could be found successfully, there are zero infractions - a real number representing a valid state.
[Cheeky note..]
In your title, you're subconsciously agreeing that 200 is the correct response:
What is the proper REST response code for a valid request but an empty data?
Here are some things to consider when choosing which status code to use, regardless of subjectivity and tricky choices: