One of the biggest issues is they are not held accountable by any agency or law. For name, address, and social security number, there is no official regulation

One of the biggest issues is they are not held accountable by any agency or law. For name, address, and social security number, there is no official regulation as to how they must be stored. For credit card data, there is the pci security standards. Which often subject institutions who choose to store payment information, to audits, as well as fines for violation. There still is no such standard for other personal information, SSN included.