The problem shouldn't be defined as "let's still keep SSN secret, but limit its collection", because sooner or later your SSN will leak. The issue is that SSN number shouldn't be considered as secret and some other measures should be used to identify the person.
The issue is that companies shouldn't be collecting ANYTHING, and what they do collect should get purged ASAP.
The problem is that every company got addicted to collecting information and nobody made them pay the price for doing so.
Companies can generate a unique identifier without using SSN. Of course, the main problem is that they can't do authentication based on that identifier. So why can they do authentication based on SSN?
SSNs were never designed for what the credit bureaus and banks and insurance companies (and everybody else) use them for, and there are too many cracks and failure cases. Companies need to admit their failures and come up with a real solution; but companies have so much sunk cost in SSN-keyed databases they aren't likely to ever actually do that. (Maybe this Equifax breach pushes more companies to try. Cynicism says companies remain cheap and invested in their sunk costs.)
A corporation needs my name, address, and probably email to do business with me. They need a credit card number when I purchase something and never else.
That's IT.
My phone number is not necessary (and everybody using it for 2 factor just makes everything less secure). What I buy is not necessary to record past fulfillment. When I buy is not necessary to record. Where I am is not necessary to record. etc. If a company stores this stuff and it gets leaked, they should be liable.
A couple of egregiously expensive fines will stop companies from collecting this information quite nicely, thank you.