As I understand it, Europe does not generally suffer from the disease of banks and courts accepting knowledge of basic demographic data as proof of identity. GDPR is not really comparable to the mess of the US social security number situation.

The risk we need is to introduce is to make banks (not customers) responsible when banks allow themselves to be tricked w.r.t. personal identity. This would motivate them to come up with identity verification schemes reflecting ~anything at all that the security community has figured out in 50+ years.