Earlier quoted context omitted.
Scaleway asked me for a copy of my Dutch passport too which I refused, and then they limited the services available to the long-time active business account this was for. Neither their docs or two separate support agents I spoke had any information on why it was necessary, where the copy would end up, how long it would be kept, etc. which seemed very fishy and is totally illegal. This was about a year ago.
You sure this wasn't a spear-phishing attack instead of a legit request?
Appreciate you asking though