We limit our ability for prospective customers to open an account online by sending them a link to proceed with the process. We use out of wallet verification tools to verify the identity of the potential customer. Sometimes, those customers will "fail" the online account opening process and we collect their valid government ID in order to proceed. In those situations, are we allowed to keep those IDs on file or must we document the information we've collected and destroy the ID?