It's definitely not just Uber. And drivers' license numbers are serious PII! It was my exact example that I gave to my last appsec talk for Ruby developers this month in Nashville.

Starting with the user story: "As a Pawn Shop Clerk, I scan a copy of the customer’s drivers’ license because the company is required by law to keep this record at least two years from the date we purchase a used valuable from a customer."

https://www.youtube.com/watch?v=dj196NhPyWs&t=26m00s

There was a good Q&A about data retention, that included a lawyer in the audience.