Does anyone see any reason why these companies should do anything other than store the data locally on your system, encrypted/obfuscated, and then only ever send once, via encrypted connection, and then immediately delete the info remotely?
I mean, if someone breaks in to my house and steals my PS3, they already have access to all of that information.
iTunes comes to mind:
http://isc.sans.edu/diary.html?storyid=9136
Either that, or perhaps there could be statutory penalties for data breaches. For example, if there was mandatory compensation of, say, $100/person for a data breach, companies might be incentivized to better think about whether they really need to store this data, and whether they're storing it safely.
A big player like sony should have been complying with PCI standards - but from what I've seen, that's not so difficult to pass and then forget about - people take shortcuts - and how many companies out there have ever had their processing revoked for NOT complying with PCI? That would be an interesting statistic.
And as an employee at a couple of PCI compliant shops, I can attest that even full PCI compliance still leaves a lot of holes (enough that some organizations have formed their own compliance exams above and beyond PCI).
And, ironically, something which I think Sony forgot here. :)
Really we're talking about the equivalent of automatic field filling, and the entire internet functions on that (at least in my browser).