Coinbase says hackers bribed staff to steal customer data, demanding $20M ransom

From the Coinbase website:

https://www.coinbase.com/en-de/blog/protecting-our-customers...

    What they got

    - Name, address, phone, and email

    - Masked Social Security (last 4 digits only)

    - Masked bank‑account numbers and some bank account identifiers 

    - Government‑ID images (e.g., driver’s license, passport)

    - Account data (balance snapshots and transaction history)

Wow. Why does customer support staff have access to images of the user's passports?

Who else would verify the user passports if not the customer support staff? Who verifies (and photocopies! in Asia and Europe) your passport at a hotel or car rental office?

When was the last time your passport was copied in Europe?

I don't think that this is still legal under the GDPR.