"it can be used to “fill the gaps” of information about any citizen. If you know someone’s birth date and the area where they live, you can obtain their government ID by trial-and-error on that website."
The mitigation is slowing down the number of guesses/second that an attacker can try. In a well-designed key derivation function, an attacker with 100x the resources should only be able to try out guesses 100x as fast. That's what scrypt/argon2/bcrypt/PBKDF2/... try and achieve.
SHA and other general-purpose hash functions tend to be easy to parallelize, at least in parts, and you can get huge speedups on GPUs or even better, FPGAs/ASICs. That's why no-one serious still mines bitcoins on CPUs and the big mining syndicates [hire planes](http://uk.businessinsider.com/cryptocurrency-miners-rent-boe...) to ship GPUs a little bit faster.
This has nothing to do with collisions. It's to do with hash functions being designed to be fast, and key derivation functions are designed to be slow and memory-hard.