There is a significant difference between someone else possessing this information, and actively distributing the information myself.
I would prefer not to have people possess the information (because I am beholden to institutions that, unfortunately, rely on security through obscurity and have abysmal security procedures) but I don't support criminal sanctions against people if they do happen to come into possession of it.
The criminal sanctions should only cover abuse of the information. If you possess my credit card information and do nothing with it, then I don't have a problem with that. If you use it to make unauthorized purchases, or use the information to blackmail or harass me, then you should face criminal sanctions for the harm caused by those actions.
Simply possessing the information doesn't cause me any harm.
I would prefer not to have people possess the information (because I am beholden to institutions that, unfortunately, rely on security through obscurity and have abysmal security procedures) but I don't support criminal sanctions against people if they do happen to come into possession of it.
The criminal sanctions should only cover abuse of the information. If you possess my credit card information and do nothing with it, then I don't have a problem with that. If you use it to make unauthorized purchases, or use the information to blackmail or harass me, then you should face criminal sanctions for the harm caused by those actions.
Simply possessing the information doesn't cause me any harm.