Sure. My view - we need concrete data about the actual harm done in cases like this. We have such data for most other types of crimes. In my opinion, saying that something bad "can" happen is not sufficient to determine the punishment.

Note this is not the same as being against punishing illegal sale of private data.