It'd be great if the law said that it's (very) illegal for the verifying party to share or store any of the PII, including with the government.