"I don't like how these people aren't punished how I want, so let's sanction crime against them" is a ... questionable concept, to phrase it nicely. Lot's of nasty precedents. Are you sure kindergardens are punished reliably enough for lapses of security?

Also:

Ransomware gangs also target companies that do not have "enormous amounts of user's personal and financial data".

Since too many companies didn't pay ransomware gangs now have taken to stealing data in addition - are you fine with a ransomware gang selling your personal data then, because they are "helping"?