Governments can hardly defend their own systems. The best policy will always be a minimal data approach. Pictures of my fucking face/ID and a number allegedly for social security payments are totally unnecessary for the actual service to be provided.