We presently go law by law, and we have a bloody fight for each one with the final result typically varying between ineffective and counterproductive.
Eventually the system works as intended; we get exhausted and give up. This is the present state of affairs pretty much all over - and has been for a very long time. There's little reason to believe a different result is soon to manifest.
leaking all SSNs makes relying on SSNs as authentication unfeasible,
the only way to stop SSNs being authentication token is to give everyone access to them, but yes that can cause short term troubles
The concept of having SSN is de facto wrong, there are situations where one needs to identify oneself unambiguously
I went to another country, and what I found is that to get a monthly bus pass I had to fill out a form that asked for:
Full Name + Gender + Date of birth + Place of birth + Mother's Maiden name + Mother's DOB + Mother's place of birth
(and so on) I forgot the exact details, but it was ludicrously intrusive. Mother's maiden name? Really??? I did not even know some of that info and filled it out with educated guesses. It is not like they were able to check ...
all that information is just an unreliable SSN
...thus making them available to the the only group left without easy access.
My larger point being that it's time to shift our concern from privacy - to disproportionate privacy.
It isn't randos who routinely harm/exploit us with our own data but those in power.
I suggest that equal privacy would serve us far better than privacy laws that target us and few else.
For equal privacy, the default starts out somewhere near: If you can see mine, I can see yours. If you're going to restrict just us, 1) you need to openly+clearly justify it and 2) the restrictions need to sunset.