For the big credit agencies, how do you tell where the info came from? If you pay your rent and you make payments on a credit card both entities may file a credit report including your SSN, name, address, etc... If the credit agency loses track of their database, how do you determine which submitter should be responsible?

It makes more sense to assign all the blame on whatever entity lost control of the data. They get a big fine and as long as they were following best practices (as outlined by their insurance company), then their insurance company will pay the fine and the business keeps chugging along.

If the company was negligent, the fine is likely a death sentence.