It would be even better if the law enforced that this kind of data could only be used for the stated business need (the basic identity verification), and not be stored or used/shared with anyone else. If anyone is caught violating a law like this, throw the entire c-suite in prison for 10 years.

I’m so tired of all these covert ops run by these businesses. They aren’t going to stop until there is a heavy price to pay.