The actual text to the decree states that the data must include the information required to validate user identity, worded in a way that allows storing plain te

The actual text to the decree states that the data must include the information required to validate user identity, worded in a way that allows storing plain text passwords, password hashes, OpenID identifiers, or whatever else you use. I have no idea why they would need the password hashes, though. I suspect they originally asked for plain text passwords, until a more technical expert came along and told them they were idiots.