Most countries require people to provide a significant amount of personal data to providers of financial services before you are able to make use of them. This is know as Know Your Customer (KYC) rules. This provides an benefit in the form of increased financial scrutiny and compliance. This provides a cost in terms of data security to the individual. This cost directly impacts the benefit, in that the more your personal data is distributed the less use it has to identify an individual. Has any government published analysis of this effect, and the conditions that must be true for this to overall be a positive thing?
The one time I have had to do the KYC process was recently when I signed up for an online financial service. This involved sending high resolution images of my passport, driving licence and face. Ten days after this process the company informed me that they had been hacked and lost all that data. At that point being able to produce these images would have been no actual use in identifying if a company was dealing with me or a hacker.
Thinking further, it would seem fairly simple to model society in terms of the number of accounts individuals have, the incidence of data loss and the length of time documents are valid for and come up with an expectation of the proportion of people who have their data in the hands of hackers. I know it is extreme, but to illustrate my point if the actual expected incidence of hacking of a set of KYC data had a poisson distribution with a λ of 10 days, then there would be far more instances of any personal data submitted for KYC in the hands of hackers than "real" people, so would be therefore of no use in financial monitoring.
Has any government published such an analysis, or otherwise explained how KYC rules function under significant rates of corporate data loss?