Most businesses don't need to store sensitive private data, it's a convenience and marketing benefit for them. The few domains that really do have a need for this data can afford to handle the data properly; and all other business should consider the cost of handling that data prohibitively high, and simply do their business without that data.

Good. If your business depends on collecting tons of personal information from people, and storing it in a way that puts innocent people at risk, your business does not deserve to exist.