This is primarily a failure of the police, but second place goes to data brokers and anyone who collects unnecessary data and doesn't secure it. A flood of personal information already leaks illegally through cybercrime and companies not protecting data, and we haven't even stopped the huge legal industry of public-info data brokers. You shouldn't be able to look up an email or phone number and get someone's family and address.

The powers that be like phone numbers because they're like a medium-level KYC. In many countries getting a phone number requires ID, and there was a recent proposal to do that in the US. Of course swatting and spam are used as excuses to introduce KYC requirements, but those problems are endemic to phone numbers, and more identity verification just causes more leaks, which gives them excuses to require more KYC.

My idea for replacing phone numbers and email: SimpleX for calls and texts (no accounts and therefore the least PII possible), and Monero micropayments for spam prevention. Most people spend way more on their wireless plan then they'd need to spend in Monero to make the initial connection, for publicly posted SimpleX links.