[p1esk]

Wouldn't you feel victimized if I listened in on you speaking with your doctor, wrote everything down, stamped your name, address, and date of birth on it and started giving out copies of the resulting paper to random people?

I would. I would also feel victimized if you mugged me (without killing me or hurting me physically). The question we are debating here is - should you be punished equally harshly in this two scenarios? I'm leaning towards "no". If you disagree I would like to understand your reasoning.

[gameman144]

Scope of impact is important here.

A doctor who reveals some information on one of their patients should be treated less harshly then a mugger of one person.

A mugger who robs ten people should be treated more harshly than a mugger who robs one person.

A doctor/company who reveals thousands of patients' information can reasonably treated more harshly than a mugger of ten people, because the absolute negative impact may be greater.

[p1esk]

OK, this is a good point. Still, you're comparing an act of hurting people to an act of potentially hurting people. An investigation into the harm done by private data sales would be helpful.