I spotted a letter in this morning's Telegraph regarding the online application forms from National Rail for Railcards. When going through the form there is section called "Identity Information" which states "Enter either passport or driving licence number to purchase online."
The obvious question this raises is "why do they need that?" If, as someone in a National Rail Enquiries lines suggests it is for purposes of identification there are three possible scenarios.
Either, National Rail compare the information against an automated online validater that hooks into the DVLA and Passport office databases - worrying given they're a private company accessing Government data on individuals. Not to mention that if that's the case then there is clearly a weak point of access that could be hacked and thus obtain access to Government systems.
Else they store the information in order to "verify" you when you call them. Worrying from the point that this is a private company storing all your personal details including highly sensitive information relating to Government documents. Think about it for a minute, if they're storing the data they have name, address, phone, passport number and they will probably have a photo too once you get the card. Identity theft anyone?
Or, worse than the previous two, they do both.