Personal data is in a very real way part of a person: it is part of their identity and without identity they are nothing in the modern world. Handling someone’s personal data means interacting with them in a very intimate way, the way a surgeon interacts with a person’s internal organs. Handling personal data involves less blood than holding their pumping heart in your hand, but should be done with the same care and respect. Neither should be done lightly, and never just because you can get away with it.

If you gather personal information about people in large quantities, if you buy and sell it, you are trafficking in identities. When you do it against their wishes, and against their best interest, you’re better than someone who kidnaps people to harvest their organs, but only because the direct damage to specific individuals is less.