It’s an escalation path. When you store and image of an ID unnecessarily, then associate it with those last four digits, you’ve created a way to link other data sources to individuals.

Most scenarios I’ve worked with, you toss the ID image once you validate it.