Anyone and anybody. If the data exists, the data can be (ab)used. Microsoft getting hacked by hackers to find out how much they knew about the hackers is the case in point. This is why "surveillance by design" and backdooring things is a terrible idea, because we need less data collection, and we need more security, not less.
I agree with the bulk of what you are saying but at the same time there are different levels of threats, gait analysis and access to massive troves of data is state-level or central corps.
Where most ordinary people run into trouble is decidedly very well down that particular foodchain.
There's all kinds of gait recognition software in the public domain as open source, and further advanced things available for small amounts of money. Like with botnets, AI, surveillance et al, the capabilities of the average schmoe are becoming quite alarming.