I'm not super on board with that disclaimer, as I think it weakens the argument that widely reselling PII is a socially unacceptable action. There are some rational reasons to resell PII to a different party (usually inter-subsidiary data sharing) but I am absolutely on board with reinforcing the liability.

Maybe the law needs to be shifted to a point where if a company collects some PII information from a user and that information is found in a breach then it is incumbent on the company to prove they were not the source of the breach to avoid being legally exposed.

I think it'd be nice if we all started viewing PII as dangerous, companies could invest the risk in collecting data on users, but it should be the default that companies try and avoid collecting as much data as possible.