I didn't just say PII, I said "PII or credit card data or anything that, if leaked, would harm your business or your customers". If you're not prepared to securely handle PII, you shouldn't be collecting it. Talking about B&M, does Guitar Center or Great Clips really need my phone number? No, they don't. So I don't give it to them. They keep this data because they want it, not because they need it.

Insanely irrational? If you are comfortable handing your information to companies who do nothing more than the bare minimum to make sure it's safe, that's insanely irrational. I get tired of companies giving my information away. I really do. There's no excuse for it.

Security is by no means a solved problem, nor is it possible to solve at this point. But how often do you hear that the company wasn't hashing, wasn't encrypting, wasn't paying attention to their security tools? Damn near every time. Things like this very, very rarely happen to companies who take security seriously.

You keep bringing up huge examples. Millions of credit cards leaked. Guitar center, a company that has 260 locations across the United States. Great clips has over 3,000 locations. Anthem, a company with multiple billions of dollars in revenue that handles extremely sensitive information for millions of people.

I remember as a kid, there was a family owned comic book shop I would visit. I would let them know what comics I'm interested in, and they would call me if they got something in that they thought I would be interested in. So they had good reason to have our phone number. It was probably even stored really insecurely (on a piece of paper). But it was the early 90's. And if someone stole it it might have included 200 phone numbers.

I buy magic the gathering cards from small card shops across the country. They need my address to ship it. Since most of these single store businesses are fairly low tech, I doubt they do too much to protect it.

Also, your initial statement also said handle, not collect. Most brick and mortar stores handle credit card data, although they don't collect it. There's even been instances of thieves affixing devices to ATMs and credit card machines that will scan your card data as you slide or insert it.

You can collect PII by hosting a static webpage (ip addresses). Leaking that PII can cause harm to users (DDOS). This may seem made up but people who make a living off live streaming are fairly regularly DDOS'd by malicious viewers who figure out their IP.

More generally, any leak of data, whether it includes PII or not, will harm a company's reputation.

This is why I called your post insanely irrational. It's all black and white: hire a dedicated security engineer, or you're doing it wrong. Regardless of size. The majority of businesses in the country would go out of business if they had to abide by your rules.

Yes, and basic information security involves weighing the cost of security breaches vs the cost of implementing security measures.

True, but the calculations companies do don't include huge negative externalities they're causing, and this needs to be corrected.