Check the licence, then hand it back

In October 2022 I asked our data platform team a question I should have asked two years earlier: how many images of customers' identity documents did Halvorne hold? The answer took eleven days to assemble and came to just over 1.7 million. Driver licences, mostly, along with passports, proof-of-age cards and a smaller number of Medicare cards. The oldest dated from 2013. Nobody had set out to build an archive of that size. It had grown one sensible counter decision at a time, and it sat in a document system that 1,140 staff accounts could open.

Australia had just watched two very large breaches unfold, at a telecommunications company and at a health insurer, and public patience with organisations that kept identity documents in case they were useful had gone. I do not want to borrow other companies' misfortune to make a point; their circumstances were their own. But the question their breaches raised for every retailer was simple. If someone reached our document store tomorrow, what could we tell 1.7 million people about why we still had their licence?

How a retailer ends up holding a filing cabinet of licences

Each source of our archive had a reason. From 2013 to 2020, customers applying in store for interest-free finance had their identity checked at the counter, and staff scanned the licence into our system as well as the finance partner's, because the partner's process occasionally lost documents and a resubmission left a customer waiting forty minutes. For click-and-collect orders above A$2,000, staff photographed the licence of the person collecting, because phones and laptops bought with stolen cards were being collected by people who were not the cardholder. Our commercial division kept copies of directors' identification for trade accounts. Each practice was approved by someone sensible, for a reason that was true when it was approved.

What none of them had was an end. A finance application is settled within days. A click-and-collect order is either collected by the right person or it is not, and any dispute is usually raised within a few months. Yet the images stayed, because keeping them cost almost nothing and deleting them required someone to decide. Retail systems are built to remember. They are rarely built to forget on purpose.

Australian privacy law already asks for that decision. Australian Privacy Principle 11 expects an organisation to take reasonable steps to destroy or de-identify personal information it no longer needs for a permitted purpose, unless a law requires it to be kept. The Notifiable Data Breaches scheme, in force since 2018, requires us to notify affected people and the OAIC when a breach is likely to result in serious harm. Maximum penalties for serious privacy failures rose sharply at the end of 2022, and reforms passed in late 2024 added a statutory tort for serious invasions of privacy and stronger enforcement tools, with further changes still being discussed. I am not a lawyer and I leave the reading of those provisions to people who are. The engineering conclusion needs no lawyer: a document we no longer hold is a document no attacker can take and no customer needs to be warned about.

Verification is an event, not an asset

The idea that changed our design was easy to state. When a colleague checks a licence, the useful output is a fact: this person showed a current document, the name matched the order, and a named colleague did the check at a recorded time. The image is evidence of that fact, but it is evidence almost nobody looks at. In our review of the 2022 click-and-collect disputes, staff had retrieved a stored image 61 times across roughly 1.2 million checked collections.

So we stopped capturing images. Since February 2023 our store systems have recorded that identification was sighted, its type, whether the name matched and who checked it. They store no document number and no picture. For high-value click-and-collect orders we moved the control earlier in the journey: a one-time code goes to the mobile number verified at checkout, and only the purchaser or a nominee named at checkout can collect. The commercial division still needs directors' identification for trade accounts backed by personal guarantees, so those documents live in a separate store with fourteen authorised users and are destroyed when the account closes.

The legacy archive was harder. We set aside 2,300 images connected to open disputes, police matters or legal holds, and deleted the rest in waves between July 2023 and May 2024, each wave confirmed by a report from the storage platform and checked by internal audit. Six months later a search of shared mailboxes and file shares found another 210,000 images that staff had emailed to one another over the years. We removed those by February 2025. I now think that search should have come first, because the copies nobody remembers are the ones a breach finds.

What deletion actually costs

I do not want to present deletion as free. Our head of loss prevention argued, correctly, that images helped police build cases against organised click-and-collect fraud, and he estimated that losing them would add about A$1.2 million a year to our losses. In the first year the increase was about A$420,000, and it fell once the collection code had bedded in. That money was real, and it came out of a budget whose owner had not created the problem.

Doing the work properly also has an operational cost. Deletion at scale needs an inventory of every place data lives, a record of what was deleted and when, and evidence for an audit committee that backups expire on the schedule we claim. Backups were the slowest part to fix, because restoring an old backup would have quietly undone the whole effort. We shortened backup retention for the document store to 35 days and tested a restore to prove the deleted images were gone.

The benefit shows up in a figure I now report to our audit and risk committee twice a year: the number of distinct people whose personal information would be exposed in a worst-case breach of each major system. Across our customer systems it fell from about 6.1 million people in late 2022 to about 1.9 million by mid-2025, partly through the deletions and partly because we de-identified 4.6 million customer records with no purchase in more than seven years. No perimeter project I have funded moved a risk measure that far for that little money.

My suggestion to other retailers is modest. List every place your business photographs, scans or copies an identity document. For each one, ask what fact the copy proves and whether recording the fact would do. Then give every class of personal data a named owner and a deletion date, and ask the board to review the exceptions rather than the policy. Keeping things is the default every system is born with. Choosing to keep less is a decision someone senior has to make, and it is one of the few security decisions whose benefit begins on the day the data is gone.