Are you 'avin a laugh mate?
A photocopy of my passport is going nowhere and is shreadded afterwards. An electronic copy..... God lord.
The GDPR also requires data deletion once you no longer need it; physical as well as electronic. This is common sense, and why some organisations don't do this is simply mind boglling.
If you think photocopies kept in some folder accessible to anyone working in the hotel, with a promise to delete it at some point, is "secure" in any way, I don't know what to tell you.
Rather a paper data breach exposed to a few hotel employees than eletronic data exposed to the entire planet!
When I toured apartments they would often take a photocopy of my ID. Okay, overkill. But realistically I have no idea where that photocopy is stored.
Probably in a OneDrive somewhere to this day.