I think sale and purchase are too hard to police. Possession of data should be illegal, with a level of statutory damages that invites litigation.