Every service that stores your identity document is holding it for you.

Every service that stores your identity document is holding it for you.

That's the polite version. The honest version: they're holding it until someone takes it.

Breach notification laws tell you afterwards. Fines are paid to regulators, not to you. Your passport number doesn't rotate. Your face doesn't expire.

The provider recovers. You don't.

So here's the question for anyone building this: if the data can't be protected forever, why is collecting it the default?