There ought to be a "HIPAA" bill for PII that only certain, special, accredited companies can hold that class of data. Password hashes, social security numbers,

There ought to be a "HIPAA" bill for PII that only certain, special, accredited companies can hold that class of data. Password hashes, social security numbers, DoB, addresses, phone numbers, bank account no., credit card no. all need to be held back and dispensed very, very carefully and in a limited fashion. Want to have a website with a login? No more individual passwords, only OAuth2 (or similar) SSO using one of the accredited providers. Preferably, there should only be 2-3 providers, all nonprofits, run as public utilities, and heavily audited.