In addition, untrue entries in their database should constitute libel. Most (but not all) of the damage from letting SSN/name/address combinations out into the

In addition, untrue entries in their database should constitute libel. Most (but not all) of the damage from letting SSN/name/address combinations out into the wild that you're referring to comes from adding false entries to their own databases, so allowing consumer to sue for libel whenever an entry is wrong would force them and their up-stream data providers to clean up their act in a hurry.