Who else would verify the user passports if not the customer support staff? Who verifies (and photocopies! in Asia and Europe) your passport at a hotel or car rental office?
A separate KYC department that verifies identity then immediately deletes the images?
When was the last time your passport was copied in Europe?
I don't think that this is still legal under the GDPR.
September 2024
All KYC processes require copying in Europe. There's nothing that's blanket illegal under GDPR. If you have consent you can collect and store whatever you want.
It's not that easy. The consent has to be freely given. And data collection has to be kept at a minimum.
If hotel staff says "Ok, last step we need to do to check you in is to copy your passport" that would probably neither count as freely given consent nor as keeping data collection to a minimum.
And KYC also does not mean you have to copy the passport of a person.