With mental health data being at stake here, the amount of victims under this definition could also very well be non-zero.
Anyway there are a lot of crimes, that don't produce those kind of victims. If I mug someone and don't kill them or destroy their life in the process, have I not commited a crime?
The privacy infringement here is an obvious damage to the dignity of everyone affected. Wouldn't you feel victimized if I listened in on you speaking with your doctor, wrote everything down, stamped your name, address, and date of birth on it and started giving out copies of the resulting paper to random people? Which is exactly whats happening here, except my example is more harmless by a factor of a few million people and has a lot fewer data points.
I would. I would also feel victimized if you mugged me (without killing me or hurting me physically). The question we are debating here is - should you be punished equally harshly in this two scenarios? I'm leaning towards "no". If you disagree I would like to understand your reasoning.
A doctor who reveals some information on one of their patients should be treated less harshly then a mugger of one person.
A mugger who robs ten people should be treated more harshly than a mugger who robs one person.
A doctor/company who reveals thousands of patients' information can reasonably treated more harshly than a mugger of ten people, because the absolute negative impact may be greater.
No ones life is directly injured because of a data leak. It's just data, it is entirely inert on it's own. Their life is injured entirely because of what third parties do with that data.
If data leaked and there were no bad actors in the world, there would be zero harm.
Also the people affected by this incident alone number in the millions.