From what I understand of protection of private information, it is up to the holder of that information to take due procaution that the data are secure. So I think the arguments would come down to how easily a "normal" computer user could access the data (i.e. the level of secturity or how insecure the system was). Making information that can be gained by any computer user is surely not the same as making public secure and evidently private information?
I think the important thing to note in regards to this breach is that the information made public has been redacted insofar as the general members are concerned. The publication of the unredacted data specifically relating to the identified accounts could be argued to have been released in the public interest or have been obtained by any competent PAIA request as it relates to the direct disbursement of members funds in excess of what is disclosed (ie. undisclosed founders mechanisms, accounts claimed to be on behalf of others, lack of adherence to international and local statutory financial AML/KYC laws) and adherence to the terms and conditions of the scheme.

