There are a couple of situations. There is the scenario you mentioned in which this information is obtained through a third party. You also mentioned these data brokers who are collecting information from people and then selling it to someone else.
What about the data brokers themselves? I understand that your bill would attempt to criminalize the obtaining of that information from the third party, but what about the actions they are taking to obtain this information in the first place?