In all the stone-throwing resulting from the theft of personal data from Optus, I am yet to see any questions regarding why the data was retained at all. We are told this wasn’t billing information. It appears to be proof of identity information collected at point of sale and, from my experience, never used again.

It is retained because the law says it must be. This applies to many other industries, most notably banking and gambling. If there was no requirement to store proof of identity information, there would be nothing to steal.