I think a lot about this subject and have a lot to say about this.

Rather than nit-pick, I want to showcase this particular item:

"I ended up going for the Disney lot, although they learned that they do have license plate readers. I was driving a rental car. Certainly, my name and driver's license are attached to that car, but that's through a different corporate database. A corporation that Disney does not own or have data rights to or share board members with ..."

(and later)

"Here I follow a different rule for obfuscation, which is to store data across corporate databases where the corporations have no prior relationship--or even an antagonistic one. I can be reasonably sure that, failing an acquisition, that data won't migrate."

This is wrong thinking.

Personal identifiers like phone number, license plate, address, etc., are commodities that are collected, digested and sold by many different third party providers.

He's thinking about Disney somehow comparing their license plate reader data with Hertz or something through some unlikely corporate agreement.

Far more likely is that both Disney and Hertz employ a third party data intel provider that gives them enterprise wide coverage and query for these, and other, identifiers while simultaneously acquiring the data to be made available via API to other "partners".

A good example of this is Ekata and their reverse phone product which, until recently, was available via Twilio API lookup:

  /usr/local/bin/curl -s -X GET "https://lookups.twilio.com/v1/PhoneNumbers/$number?Type=carrier&Type=caller-name&AddOns=ekata_reverse_phone" -u $accountsid:$authtoken

... and would give you not only a reverse number lookup but also a list of "associated persons" as well as your address and number history.

I feel assured that APIs like this exist for license plates, SSNs, IMEI, etc.

I also strongly suspect that Disney and Hertz are both contributors to, and consumers of these APIs.