Also there is no reason that misconduct of this kind couldn’t be prosecuted under laws preventing similar breaches that aren’t digital in nature.

Selling private data for bribes should be illegal whether or not it’s a database or a file cabinet.