> or retaining drivers licence photos after test driving a car,

mind that there was a breach recently where all the data was being leaked *the moment it was collected*

so simply controlling retention is not enough. The very fact of data being taken is already a vulnerable part