Good question. The number of copies and scans do my passport floating around does make me uncomfortable. Most online services require a scan or image of your passport to authenticate you when you’re locked out of your account. I’ve also been asked by AirBnb to submit an image of my passport when I had a dispute and wished to claim a refund.

At least with hotels most passport copies are stored on paper file, not digitally. I’m more concerned about the security of various online services that store many copies of passports (e.g. background check agencies, estate agents in the UK, and any website where you need to submit a copy to authenticate yourself - online banking or trading firms). A breach of such a database could be used to impersonate one to your email provider and gain access to your email. That’s often the key to then compromise your other accounts and digital wallets. Not sure what Google’s account recovery process is, but fairly certain it includes submitting ID such as a passport photo.

GDPR should help here, as data should only be held for as long as necessary, but there’s no way to be sure that hotels or online firms are complying with such requirements. And of course a moot point outside the EU.