As applied to banks it seems not so bad
Certainly in the US it’s a catastrophic shit-show. The law only requires collection of 4 pieces of info, but the same law says “and banks may also collect whatever the hell they want with immunity to damages”. Then US banks lie to their customers and say “we need your annual income because KYC because US Patriot Act”.. and people simply believe it. They don’t know the says the bank legally /can/ collect it, but that it’s not legally required.
Then when the data breach happens, the cyber criminals get a huge treasure trove of sensitive data the bank did not need in the 1st place. When the breach is on an outsourced entity, no law in the US requires that outsourced entity to disclose to victims which bank supplied the info. So e.g. Citibank gives your data to corp X to do a some arbitrary service. Then corp X (who you never heard of) sends you a note: “we were breached... sorry.. here, have some free credit monitoring through this Cloudflared website”.
Victim: which bank gave you my data?
corp X: (crickets)
It’s astonishingly stupid how many Americans are naïvely okay with that arrangement.
but they keep expanding it to new types of business.
Indeed, VOIP may be next abuse of the KYC anti-privacy model. Why not.. if the masses are stupid enough to lick bank’s boots, surely people can be conditioned to go along with tossing their privacy out wherever else KYC manifests from the Orwellian playbook.