The practice of scanning ‘proof of identity’ documents is becoming more common.

A business may only scan customers’ identity documents if it is
necessary for its functions or activities. In the first instance
businesses should consider whether identification is required and, if
so, whether simply sighting a ‘proof of identity’ document without
scanning it would be sufficient.

Privacy Commissioner’s Information Sheet