The ID scans in the article weren't submitted by people from their phones. They include IR and UV scans, too. The database might contain multiple sources but at least the big one appears to have a lot of IDs from physical locations where you hand your ID over the counter to someone to scan.
replys/retained/leaked/
replyWell, yeah. Retention eventually means leaking.
replyI deliberately throw away logs, customer data, etc once it ages last a certain amount simply so I can stop being responsible for it.