I think you've strayed somewhat from my initial question.
If, in order to do business with a company, a consumer must provide his credit card number or his social insurance number, then the onus is on the company, and not on the consumer, to keep track of what happens to this information. As consumers, we comply with company requirements. If we knowingly disclose our personal information to this company, we do so believing that it will handle our personal information in a responsible manner. As consumers, I'm sure you have the same expectations.
Hopefully, you won't find yourselves in a situation where, having misplaced your personal information, company officials wouldn't call you for fear their name would be published in the newspapers. Nor should someone be able to steal your identity and make you out to be a criminal. As a consumer, should you assume full responsibility for this situation, or is the company responsible for misplacing this information?