the CFAA doesn't apply to pigs who steal PII maliciously, it only applies to individuals who download information to share with the media in the public interest.

https://www.cnn.com/2021/06/03/politics/supreme-court-cybercrime-law-case/index.html