I was just about to work for an agency, until I recieved their agents email and attached forms, in the way of a forwarded email message, and from this email I also got all the other drivers email addresses too… and this person wanted me to email all cards passport etc into them 
wasn’t happening.
Absalute lazyness by the agent, forms sent weren’t even clear, just badly scanned and thrown on as an attachment, screamed unprofessional, yet running a huge contract ■■?
This was a total breach of GDPR, never told them why I had decided not to work for them, just called them after recieving the email, and said didnt wish to continue, then got attitude, but just rolled my eyes and thought avoided bad expereince, luckily believe in karma or could of passed it on and their agency would be paying out big style… as its a self funded part of goverment, so they go for the throat on any opportunity
Noticed the same possible issue as you ,so what Ive started doing if sending in documnets and card details via emails, is I use Gmail, and it has an option to prevent forwarding and copying and destroys the email after a period of your choice say 24hrs, so I at least know details and documnetation that would easily allow identity theft are not sat on an agents laptop, that they leave on a bus or train etc.
I do other work along with HGV and I seriously think there one day could be issues ahead with the amount of stuff these recruitment agencies want today, and do wonder how they store the information, old days used to be photocopy print off and in a locked filecabinet, now expect on a server, so identity theft is a real concern, 100’s of identities in one place… identity thieves ■■■■■■■■■
3 driving cards /1 ni number document /, passport /, mobile bill / and bank account number easily open up another bank account, or take out a loan…
probably be able to take over your current bank account if mobile details too… starts with a new sim request…
Know the big companies do this stuff correctly, but as seen by that agencies Agent, some agencies it appears dont care,… and glad they dont hold any of my personal details…