Most businesses don't need to store sensitive private data, it's a convenience and marketing benefit for them. The few domains that really do have a need for this data can afford to handle the data properly; and all other business should consider the cost of handling that data prohibitively high, and simply do their business without that data.