> Companies should only collect data that they really need.

Collecting and keeping this data is a regulatory requirement for Optus.

The problems with this breach have their roots in how identity is proven and verified in Australia. Far too much relies on possession of a physical document.