If, instead, there were limits on what could be shared and companies were credibly liable for misuse, breaches, etc. I think many people would be far less concerned with use of information.
> Your face, your voice, your fingerprint, your iris, all of these things cannot be spoofed and are uniquely yours and cannot be taken away from you.
Conversely, this illustrates how important it is to have massive penalties – on the scale of “you are out of business and managers cannot have a position of authority involving personal data for years” – for storing biometric data because there's no way to recover when it's compromised. This is particularly important when you realize that biometric data cannot be trusted over a network connection so there's no point in deploying biometric systems anyway because they can only be trusted when one entity has end-to-end control over the entire system.
What should be deployed is PKI which, unlike direct biometrics, can be made robust against compromises using a revocation mechanism. This also allows biometrics to be used safely because you could have an authenticator which uses biometrics which never leave the device and has no replay value for an attacker once a compromise has been discovered.
Consider the recent breach at the U.S. Office of Personnel Management. The attackers reportedly got everything listed on background and security clearance applications, which burns every common authentication system because the attacker could easily answer most “security” questions. Consider how much worse that would have been if biometrics were in common use and scans of fingerprints, voice or iris patterns, etc. were also available to the attacker.