> This seems to be unforced data retention, I didn't get that impression. Drivers licences and passports aren't things banks generally care about. It sounds

> This seems to be unforced data retention, I didn't get that impression. Drivers licences and passports aren't things banks generally care about. It sounds more like the "know you customer" and "anti money laundering" hoops all financial institutions are forced to jump through now. The rest of your comment rings true, although "spy agencies" is too narrow. It's spy agencies, police, the tax office, the social welfare agencies (like Centre Link in Australia), the financial agencies like Australia's ASIC. I don't think it's politically possible to stop the data collection. A few real terrorist plots in Australia have been caught with this data, banks have been fined billions for allowing what is effectively money washing. Regardless of what I personally think, the Law Enforcement Agencies will say not collecting this information is the equivalent of "let the terrorists/paedophiles win" making any argument to stop it a near impossible sell. But that doesn't matter. You can insist this data is collected without creating a wide open barn door like we have currently using cryptographic protocols. As an example, the government could you an app on your phone, lets say a car rental agency requires proof you have a valid drivers licence. You present the phone to an NFC reader, the phone says "XYZ Business has an authority to verify you have a current licence and it's expiry date", you click "hand it over", the phone provides the required data to the rental company. It's signed to prove to the rental company the the government has certified you have a licence expiring on some date. It also contains a lot of details about you the police can use to chase you down if you are in a road accident - but that's all encrypted, so no one can see it, including the car rental company. So it doesn't matter if it leaks. Barn door closed. Well sort of. The car rental is probably going to collect a lot of information about you anyway, like a name, contact phone and address. But that's because they want it, not because the government demands it. Hopefully those details won't be sufficient to pull off identity fraud. The government ID's they are collecting now definitely are ID fraud material. This way of handling sensitive data isn't novel. We already do something like this for credit card details. When a web site offers to remember your credit card, it's likely they've never seen it, let alone remember it. The only people who have seen it is the payment processor - Stripe maybe. What they are remembering is a token Stripe gives to them, which they can use to charge your card again. But the token reveals nothing about you. What's more it is useless to everyone bar them - Stripe won't accept it from anyone else.