[gameman144]

Scope of impact is important here.

A doctor who reveals some information on one of their patients should be treated less harshly then a mugger of one person.

A mugger who robs ten people should be treated more harshly than a mugger who robs one person.

A doctor/company who reveals thousands of patients' information can reasonably treated more harshly than a mugger of ten people, because the absolute negative impact may be greater.

[p1esk]

OK, this is a good point. Still, you're comparing an act of hurting people to an act of potentially hurting people. An investigation into the harm done by private data sales would be helpful.