If there's no meaningful reward or punishment for keeping or leaking PII, companies won't do anything about it. They'll keep collecting sensitive inf unless they're educated or forced not to collect unnecessary PII.
Speaking as someone who has had companies give away my PII and then other companies open accounts with it without contacting me until bills are due.
None of this should be the fault of innocent individuals.