Get hacked and leak it for starters, as has already happened with Discord. And social media is a loose definition that can be expanded to include whatever you want. Currently Lemmy and Mastodon are not included but it could be. And Lemmy currently has none of my personal information so uploading my ID would be infinitely worse than what we have now. And before you say it’s not feasible to force all instances to comply or be blocked that won’t stop them trying.