For example, financial companies are required to get reams of highly sensitive data to do KYC checks. The thing is, most companies would greatly prefer NOT to have to access and store this data, but they are legally required to. As a data point, when Stripe came out with their Stripe Identity product, many were surprised that, unlike their credit card processing where a merchant never gets to see any card data, with Stripe Identity the full image of highly sensitive data like drivers' licenses and passports are available to the Stripe clients. But the reason for this is that KYC rules require this data to be available to financial institutions. See top comment on https://news.ycombinator.com/item?id=27502993 and Patrick Collison's response.
IMO the only way this problem will ever be solvable is with some sort of broad-based tokenization solution. It's just impossible for most large companies to keep this data secure forever.
The real problem is that the data is considered sensitive in the first place. It's essentially publicly available data at this point and entities that want to extend credit to a particular individual should not be able to solely rely on that data to extend credit.
The law needs to be changed to allow an individual to sue creditors and credit bureaus for libel when they accuse them of failing to pay or defaulting on a line of credit.