It really doesn’t matter how you spin it, the fact remains that organizations have obligations to those who donate and confide in its “agents” — that obligation is to not disclose privileged information to unauthorized third parties, and to protect their money. It’s the law.
You don’t like it, fine. Go try and get the law changed then. That’s how you address it. Other than that, deal with it and shut up.
You want justice, sue the abuser. But beware, the abuser likely doesn’t have millions of dollars for them to sink their teeth into. That’s ok, just tie the crime to a rich person/organization.