Much complication.
I read the linked article to get more details and it is interesting. As the article points out, they were charged because of the 'misappropriation theory'.
" ...when he misappropriates confidential information for securities trading purposes, in breach of a duty owed to the source of the information ..."
The article goes on to explain that the information belongs to Capital One/Visa/Mastercard but they are looking after it for Chipotle, to whom it ultimately belongs.
But heck, wait a minute. Surely that information really belongs to the people who spent the money in the first place? It was the customers of Chipotle (and other companies that were monitored) who bought goods and had (eventually) to pay for them who created that information in the first place. I'd be in favour of a system whereby any profits of this type of activity were shared with the people who's credit card spending was analysed for that purpose. (Yeah, fat chance, I know).
My point is that the 'creators' of the information (the paying members of the public) are not regarded as the owners. It is the corporations who take ownership of it in the same way that Google etc. take ownership of creative input from their contributors and the NHS in the UK are about to take ownership (and sell) information provided by members of the public who have medical problems - all to the monetary benefit of corporations and those acting as government contractors.