1. Cambridge analytica did not actually buy the data. If I remember correctly, they scraped it. I might be wrong, but I think virtually all the information we put on the web is available to anyone who has the tools to get it. So is this simply about the fact that other people are benefiting financially or is it that the information is being given/used by someone else.
2. There is absolutely no way that data on the web cannot be used criminally. This is not a privacy issue.
3. People give out information about themselves all the time - how is it private? How is anything on the web private?