I think OP was asking: even though there are best practices to follow when storing PII, how can we trust every private entity that stores our PII to be using those best practices?