Why is that true? Especially with such "must have been" certainty?

Or is "publicly available" used here to include data breaches and data sold by gray area data brokers? If this is your point then what would qualify as private information ? If this isn't your point