and instead demand your passport and other identification, scan it and leave it in their system forever. They also are known to sell this data to other from time to time.

Isn't this the problem vs the Supreme court judgement? Why does the hotel need to save this data forever?

A simple fix will be to make companies liable for leaks of personal data. That alone will incentivize then to delete personal data as fast as humanly possible.