It's OUR data, and WE as individuals are the ones who have to clean up the mess after aggregators spill it.
Perfect security is impossible, but let's not forget 1) who is harmed, or 2) who is getting rich and who will in a worst case will cut their losses, go bankrupt, then start another company with the accumulated weath.
Then don't give your data to anyone. Perfect security doesn't exist, no matter how hard you try or how much money you throw at the problem. Breaches happen, end of story.
So the real issue should be: When and how will a new secure form of identity be created, used, and made available. Social security numbers were never intended to be used in the manner in which they are.
In my country (NZ), it is my data. It's the literal law that any agent that collects personal information needs to follow a number of rules. (Search for NZ privacy Act for the gory details).
I'm allowed access to the information, and can request that it be updated. They can't keep the information longer then is necessary, they can't use it for anything other than the original collection purposes, they have to take reasonable measures to secure it, they can't disclose it etc.
I won't harp on about the details, but it's relatively well thought out (apart from some limitations regarding the reporting of breaches, but there are changes in the pipeline to patch that up).
That may be the case in the US, but here in Germany I could sue you if you made that picture public. Here people have the right to decide whether pictures of them can be made public or not (with some exceptions).
Perfect security is impossible, but let's not forget 1) who is harmed, or 2) who is getting rich and who will in a worst case will cut their losses, go bankrupt, then start another company with the accumulated weath.