Information cannot cause harm. Harm is done by people.
Intention exists separately from information (in this context) but they are not independent, they're connected.
A silly example: Let's say someone at Facebook realises they could predict with high confidence the chance of a user voting in favour of extremist political candidates. This is new information, and Facebook has decided to create it. Once created, it could do harm. At this point, saying "information doesn't kill people, people kill people" is a useless abstraction. Sure, it might be "true" in a limited interpretation, but that interpretation doesn't help anyone.
(From an excess of caution, I've constrained the definition of "information" above as something like "information created or collected by humans and our systems". This is to exclude exotic-but-true consideration of literally anything in the universe as "information" e.g. tumours, magnetars, etc etc.)
This line of thinking was used during the dark ages to argue against the spread of science vs. religion.
But collecting information can enable as much harm as collecting some numbers. For example the Nazis started with collecting information about the racial status of as many people as possible, see [1]. The collected information was later used to decide who to deport and kill.
Although, this is another example of humans causing harm, it also shows why collecting information is not harmless. Although the information itself cannot cause anything. It simply has no agency, so it can neither harm nor heal people. But it can enable both.