You're missing a huge point here.  If confidentiality of personal information is the main or  governing concern here, why is it not equally outrageous for the state(s) to sell the same information to anybody who has the money to plunk down?  (Personal information is no longer personal in our world!)