Show me why you kept my ID
A hotel counter, an unanswered shredding question, and the ID copies a business agrees to hold
Issue 028 | Friday Brief | October 30, 2026
Weekly field intelligence for enterprise and mobile security leaders
I was back home in Georgia for a funeral and had decided to try a local hotel. I was tired. As I handed over my passport, I asked the guy at the front desk, “Do you have to take a copy? And where do you keep those?” Behind him were paper copies of IDs, sitting face up. A color copy of an out-of-state driver’s license was close enough for me to read the name and other details from where I stood.
He smiled and gave me an explanation about security. I asked whether I could take the copy at checkout. He refused, citing compliance. I asked whether they had a plan to shred the copies properly, and when. I got a nervous laugh and another reference to policy. The answer never got to the handling of the paper I could see.
That felt like security theater. I was being asked to accept the hotel’s care of my passport while looking at someone else’s identifying information. I could not tell how long those copies had been there. I almost asked about their contracted third parties, but I was tired and did not feel like having the back-and-forth with someone else’s leadership through the front desk.
I wanted a room and a straight answer about the copy. A business asking for my ID should be able to explain what it keeps, who can get to it and when it goes away. The IDScan.net incident gives a clear example of what can happen to copies held beyond the counter.
Signals & Moves You Shouldn’t Ignore
The vendor held the customer’s ID
IDScan.net says an unauthorized party accessed part of its cloud environment between April 4 and September 2, 2026. Its September 29 update says the incident was limited to VeriScan and that the information involved varied with how each customer used the platform. [1]
Harborside’s October 3 notice makes the customer consequence explicit. The retailer says the information potentially involved included the front image of an ID, identifying details and records of when and where it was scanned. Harborside says its own systems were not involved. Its customers were receiving a breach notice because of information held by the verification provider the retailer used. [2]
That belongs in the vendor review before the next renewal. The customer presents an ID to the business in front of them. The business needs to account for the information that transaction leaves with its service providers.
Retention starts with a setting
IDScan’s current support documentation says new accounts default to “Collect all” and new customers default to retaining all records in its cloud. The same page describes collection and deletion controls, with availability depending on the plan. It distinguishes cropped photos from attachments that can include high-resolution scans of an ID’s front and back. [3]
Those are the documented defaults today. They do not establish how every account involved in the incident was configured. They do give procurement a concrete question: which collection and retention settings did your business choose, and who checked them against what the transaction required? A vendor’s available deletion control still needs someone to configure it.
The copies already come with obligations
Georgia’s Attorney General has addressed almost this exact hotel complaint. Its guidance says a hotel can request and hold an ID copy for a period of time, while emphasizing protection and proper disposal. Separate Georgia guidance covers records containing passport numbers, license numbers, photographs and dates of birth. It describes shredding, erasing or making the information unreadable when disposing of those records. Neither page establishes a universal requirement to hand every copy back at checkout. [4] [5]
I am in Baltimore now, so I looked at Maryland too. Maryland requires reasonable safeguards for covered personal information about its residents and, in specified service-provider contracts, requires the business to put security obligations on the provider. Its disposal law also requires reasonable protection when destroying covered records. [6] [7]
Federal privacy law is fragmented, and the FTC already brings privacy and data-security cases under its authority over unfair or deceptive practices. [8] A front-desk employee should have a usable handling procedure and someone to call about an exception. A guest should not have to work out the applicable law while checking in.
The Control Gap
Checking my identity gives the hotel information for a transaction. Keeping a copy creates a record the business has to look after. The handling should be explained all the way through disposal, including any company that receives the record along the way. That applies to the paper behind the desk and to an image uploaded from a phone.
My concern extends to the vendor’s vendors, the fourth parties that may sit beyond the company I recognize. I never got as far as asking the hotel about that chain. I want the business to explain which companies receive the information, for what purpose, under what authority and for how long.
The FCC’s roughly $196 million in penalties assessed against wireless carriers in April 2024 came to mind. The FCC said the carriers sold access to location data through intermediaries and failed to ensure that valid customer consent was obtained. Those are telecom-specific obligations, so the dollar figure tells me nothing about this hotel’s liability. It does explain why a vendor’s vendor gets my attention. [9]
My Take
I want the person who approved the copying requirement to stand at that counter and answer the questions. Explain why the full image is needed, how it is protected and what ends the retention. The employee should have a process they can follow and explain. Invoking compliance while leaving those answers unresolved puts the guest and the employee in a conversation leadership should already have settled.
For hotel groups, rental operators and other businesses checking IDs, start with the records the business has agreed to hold. Some will have a valid legal or business reason to remain. Identify that reason and keep the required records securely; have counsel confirm retention requirements and preservation holds before changing disposal rules. The FTC’s guidance already tells businesses to limit collection and keep sensitive information only while there is a legitimate need. [10]
For a cyber broker or underwriter, I would ask: which ID images are held by the insured and its service providers, and what evidence shows that retention ends when it should? The immediate value is a specific set of records and handling practices to examine.
One Thing Worth Doing This Week
Follow one completed ID check from presentation through its scheduled disposal. Use the free Build In-House ID Copy Handling Record to review one counter or digital workflow. The fillable PDF gives operations, procurement and your broker a shared record of what is supported, what has only been stated, and what still needs an answer. Keep these four answers on it.
- What did the check require? Name the condition being verified and the reason for each field or image collected. Distinguish the original document, paper photocopies, digital images and extracted data.
- Where is each record held? Follow paper and electronic records through storage, staff access and service providers, including their providers. For a copier, establish whether the device also stores an image. [10]
- What ends retention? Identify the applicable requirement or business purpose, the period or event that ends it, and any preservation hold. Check the actual procedure and system settings.
- What shows disposal happened? Use the available destruction or deletion records. Record any limits, including backup retention. Give each missing answer a person responsible for getting it.
A record still within its justified retention period should have a protected location and a scheduled next step. A completed disposal should have evidence. Keep the conclusion limited to what this review actually establishes.
Download the free ID Copy Handling Record
Fill it in privately or print it. No signup required. Keep customer names, ID numbers and images out of the worksheet, and keep completed records in your own systems.
Field Notes
At the counter, I stopped asking. I knew enough to question the process and still did not have the energy to make a night of it. That is part of the design problem. The customer should be able to get a plain answer without turning check-in into an argument.
That is also the standard I want buyers to apply to my work as we head into next week’s launch. Anyone claiming to keep less information should show exactly what is collected, what remains and which systems or service providers are in scope. A zero-copy claim needs an explanation a buyer can examine.
For teams dealing with ID uploads in account recovery or approvals from personal phones, bring one workflow into a Mobile Risk Reduction Exercise. We can scope the review around the information the business needs and the records it ends up holding.
What would your team tell the next customer who asks when the copy gets shredded?
William
EVERY FRIDAY. SIGNALS. ONE CONTROL GAP. ONE ACTION.
Sources
Sources checked October 30, 2026. The hotel account is William’s firsthand recollection. The property is unnamed; no connection between that property and IDScan.net is asserted. Legal references describe their stated scope and do not establish a violation at the hotel. The review exercise and proposed insurance question are the author’s recommendations.
[1] IDScan.net: Notification of Data Security Incident. Updated September 29, 2026.
[2] Harborside: Notice of Data Breach. October 3, 2026.
[5] Georgia Attorney General: Disposal of Customers’ Business Records.
[7] Maryland Commercial Law, §14-3502: Protection of covered information during record destruction.
[8] Federal Trade Commission: Privacy and Security Enforcement.
[9] Federal Communications Commission: FCC Fines AT&T, Sprint, T-Mobile, and Verizon Nearly $200 Million for Illegally Sharing Access to Customers’ Location Data. April 29, 2024. Related court records: Supreme Court, FCC v. AT&T, June 4, 2026, addressing procedure and the AT&T and Verizon penalties; and Sprint v. FCC, D.C. Circuit opinion of August 15, 2025, reproduced in the Supreme Court petition appendix, addressing the location-data chain and Sprint/T-Mobile penalties.
[10] Federal Trade Commission: Protecting Personal Information: A Guide for Business.