The biggest problem is that we've become conditioned to using our name/address/SSN/birthdate/etc for everything, so we give this info, without batting an eye, t

The biggest problem is that we've become conditioned to using our name/address/SSN/birthdate/etc for everything, so we give this info, without batting an eye, to services who have no legitimate need for it. We're basically using the same username/password for all of our most sensitive accounts. For example, an orthodontist in my area asks for SSN, employer, marital status, spouse's SSN, spouse's employer, and states "you must complete the entire form". I only enter name/phone/insurance info, but I bet most people will just do what the form asks. So part of the responsibility is on the user to not willingly give away irrelevant data. Part of the responsibility is on services to be good stewards of data. What should Congress do? How about unifying PII and IP? Give Equifax the Napster treatment.