These rules aren't about leaking data accidentally (everyone already tried to stop that), "exposing" it is vague, not sure what you mean by that.

And as for selling personal data - er, how? People get drinking water from rivers. If they're polluted you can get very nasty symptoms. I've never heard of anyone being sent to hospital because someone sold their data.

At any rate, if the goal was to tackle data trading then there'd be no need for a "right to be forgotten" which is where most of the confusion and ambiguity comes from.