Until holding and losing PII (Personally Identifiable Information) is treated and punished like holding and losing radioactive waste, this will not stop.

The penalties for losing PII should be sufficiently high that even the most junior programmer should recognize the probably and immediately blanch whenever asked to write code about it.