[Zak]

Any attempt to answer that would heavily depend on how a "victim" is defined in each case.

Are people who attempted to opt out of online tracking, but got tracked anyway[0] victims? That's probably less severe than this case where a company sold health information, but it's definitely illegal in the EU and likely at least a deceptive business practice in other jurisdictions.

Are people who buy drugs and harm themselves by overdosing or spending all their time intoxicated victims? If the person is an adult and the drug is alcohol, that's not even illegal most places.

Are victims of secondary crimes victims of the illegal drug trade, of drug prohibition itself, or simply of the secondary crime? One could easily make a case for any of those.

[0] https://www.theregister.com/2023/03/03/online_privacy_tracki...

[p1esk]

One definition of victimhood could be how much a person has suffered as a result of the crime. I'd say if someone has lost their job because the data leak, or had their identity stolen with actual serious financial consequences, they are a victim.

True, a lot of people are victims of their own stupid decisions. A society should still try reduce the likelihood of the stupid decisions, especially when there are obvious bad actors actively trying to increase such likelihood.

[anigbrowl]

But your approach requires us to wait for something bad to happen to someone else before forming an opinion. Why exactly should people whose privacy has been violated have to be sacrificed further before any value is assigned to their privacy? We can use retroactive data to estimate the downside risk.

[p1esk]

Sure. What does the retroactive data say? If the data is bad then I agree - it should be punished accordingly.

[Zak]

When measuring a large scale crime like that of Cerebral, the number of victims is as important as the magnitude of the impact. There were 3.1 million victims. Stealing a dollar each from 3.1 million people would get the kind of law enforcement response that stealing $3.1M does even though the individual impact of that crime is virtually nil.

[p1esk]

Stealing a dollar each from 3.1 million people would get the kind of law enforcement response that stealing $3.1M does even though the individual impact of that crime is virtually nil

That's an interesting question whether it's fair to treat it this way. I can see valid arguments on both sides.