Which web application attack is more likely to extract privacy data elements out of a database?

The answer is SQL Injection

This kind of attack is the most prone to extract privacy data elements out of a database. An SQL injection like any other attack may take several attempts to pull it off and is more likely to extract private data. With admin rights or escalated priviledges, SQL injections can be used to enter the database.