If hackers compromise it, they could extract sensitive personal information and ... Without clear data retention policies, entities could store scanned passport details indefinitely.