There were numerous massive data leaks from Experian and other private data aggregators, because they operate on for-profit basis and privacy (they call it “non-functional requirement”) is the easiest one to save on (=increase profit).
Right now they aggregate enormous amounts of highly sensitive data, which we are obliged to handle to them specifically because there’s no single national id in the UK.
Whoever would implement the database, they would operate under government mandate and rules, which are much more strict about data protection.
What I personally see even larger threat (as someone working in infosec) is that this sensitive data is passed to a network of rather obscure companies (rental, recruitment, financial, property etc) who are physically unable to properly handle and dispose of it, even if they wanted.
Which is why when someone speaks of opposition to national id in order to “protect privacy” I open my eyes wide, as it’s having exactly opposite effect :)