I wonder how it changes the calculus when medical data is leaked into the public domain then hoovered-up by data brokers.

Is a law being broken by a data broker if a credible case can be made that the data was publicly available?

I would think the leaking party would be subject to action, but does the "taint" of the data being private somehow get "washed away" if it becomes publicly available? Asked another way, is a party who consumes illegally-leaked but publicly available data also on the hook for privacy regulations.