Are we still talking about factual comment of them requiring IDs or the completely unfounded speculation of them using it for all manner of things beyond regulatory compliance?

The former is a fairly defensible position. PCI standards for this sort of data collection should be a government matter as they are the ones requiring this information to begin with. The latter isn't based on reality and not worth arguing about.