I don't follow the distinction you're making about GDPR. I don't think anyone is saying they shouldn't have this information, just that they should make at leas

I don't follow the distinction you're making about GDPR. I don't think anyone is saying they shouldn't have this information, just that they should make at least some minor modicum of effort to secure it. GDPR doesn't say you don't need to properly secure data even if you're legally required to collect it. GDPR solves this problem as much as any legislation can.