That is precisely the data that rightfully belongs to individuals. It should be much, much harder for companies to collect it and sell it.
"Data is a toxic asset." — Bruce Schneier
Pretending that a "secure" system can be devised which will protect that data is irresponsible, because it is impossible. The data will leak eventually.
When it does, under the current regime, the damage inflicted on individual victims is wildly disproportionate. Equifax is the analogue to a gross polluter dumping dioxin into a community's backyards. But getting damages proportionate to the harm out of Equifax is hopeless, because US laws do not acknowledge the toxicity of data.
The US needs something like the GDPR in order to protect us from grotesquely harmful institutions like the CRAs. We are in the early days of the internet, akin to the early days of the industrial revolution — before the harm that toxic chemical pollution causes was recognized and regulated.