Maybe he doesn't want to send them a copy of his national ID for the sake of privacy.

Are privacy guidelines in EU countries so well defined that they take terms such as "password for an online service" into their vocabulary?