That model is possibly better for securing (high value) private systems, but not for social media and non-contracted (public) services like Gmail.

As I've said in other places here, those other sites and public (corporate owned & improperly-regulated) services need to be properly governed and instructed to not store data they don't need at all, like phone numbers, passports, and driver's licenses. There should be harsher penalties imposed on companies for data compromises to discourage unnecessary personal data gathering.