The rules for financial, medical, government or any organization which requires personal information to conduct business should be such that the organization is allowed to disclose this personal information only if it has written authorization from the individual.
Private information is disclosed too readly by most institutions.
Two examples of this follows. A friend of mine purchased a CD-ROM from WallMart with private information such as name, address, social security number, the remaining ballance of his house loan etc. This CD-ROM probably had every person in the USA on it. The second example is I had to give out my social security number to a credit agency in order for them to tell me information about an unknown debt of mine which was on my credit report. Privacy rules should be made stricter to keep private information private.