So, as a former employee of one of the companies named in this article, here's a rough outline of the dataflow:

The Data Trust is the main data affiliate of the RNC. The RNC pays The Data Trust to collect voter data (public information) and scrub it. This involves hundreds of tedious calls to every town clerk in the country and the payment of many data fees (which are usually small, about a penny a name on average). The Data Trust then cleans this data into one cohesive format, which is no easy task considering voter rolls differ substantially throughout the country. The DNC has their own data subsidiary who does the same thing. They are also involved in the purchasing of various consumer data (ie: discount card purchase lists, magazine subscriptions, etc.)

After the Data Trust cleans this data, smaller analytic companies buy the voter rolls and play with it numerically. These companies (like Deep Root, the offending organization) are the employers of the industry math geniuses who make their own predictive/proprietary algorithms that (supposedly) are predictive of voter behavior.

This leak was only of Deep Root's original purchase from the data trust + their own internet scrubbing efforts. No private consumer data was leaked. Although they were likely contractually obligated to keep it private as per their agreement with The Data Trust (NOT the RNC), since the only data leak was of publicly available information, their only transgression legally speaking was violating a business agreement - not infringing on citizen rights.

Obviously that last bit was speculative since I'm no longer employed at the company, but thought I'd chime in.