Why 10 years? I mean, I don't see how one could defend any term shorter than the term of the validity and danger of the information stolen. I won't get a new SSN in 10 years. I won't get a new name. All the information will persist and still be useful. I'm personally in a worse position as my information was part of the OPM breach years ago and even images of my fingerprints are in the wild. And I got 18 months of free credit monitoring out of it.

When a charge of more than $100 is made on my credit card, I get a text message instantly. When I log into my banks web system, I get a text message instantly. I was able to set those things up. I don't see why it would be unreasonable to have a similar thing set up so that I could be alerted every single time my credit history is queried with information about who is querying it for what purpose, ideally with the ability to block it by replying to the text message.