Why is selling this data not illegal and harshly prosecuted?
You'd expect to find this data being stolen by trojans and sold for bitcoin by anonymous actors on blackhat sites, not by registered companies with offices and employees.
A more generous interpretation, that does not require buying into the generic, unactionable cynicism that everyone is corrupt, is simply that new laws require neat, easily comprehensible and emotional stories to be enacted.
As examples I would cite federal hate crime legislation, enacted after a particularly abhorrent lynching of a gay teenager IIRC. Or the current change of approach to Saudi Arabia’s ruling sadists: of course their industrial slaughter and engineered starvation of children in Yemen is the far larger crime, but the smoking bone saw of Istanbul just grips us far more viscerally.
It’s astounding to me that this same country with HIPAA laws protecting name, ethnicity, age, and any identifying information in hospital records has nothing on the books to guard that very same information which can easily be bought and sold if it came from anywhere other than a hospital.
You'd expect to find this data being stolen by trojans and sold for bitcoin by anonymous actors on blackhat sites, not by registered companies with offices and employees.