“We have been continuously exfiltrating new data for over a year into our private database.”
A year. They sat inside an identity verification vendor for a year and nobody noticed until a reporter went looking. Every bar, car rental counter and retailer that scanned your license handed it to a third party you never agreed to trust. The service only went dark after the story published, which tells you exactly what the compliance paperwork was worth.