The only solution is to put the data in our hands only and we authorize access to it on an as needed basis. It should not be centralized anywhere.
At a later date, I autorize credit card w to access some computed score that I compute and verify via other trusted means (another blockchain or whatever). Credit card w never sees all my data and the verifier gets access to only what it needs. Nobody needs to trust anyone and instead trusts the chain. Just an idea.