That’s actually part of the problem.

Pretty much every company will contract a 3rd party service to perform those checks, making sure they get as much bang for as little buck as possible. Said services are usually the weak link that shares the data with others, often through PNGs in public buckets so that Russian teenagers have an easy job CURLing them.

If the government took security seriously, it’d endorse a solution and then take responsibility for it, given it came up with the law in the first place.