Their system is subject to EU data protection and privacy law. They probably could actually just refuse her service, that would be a different case. Although if they started banning transgender people, or foreigners with strange names, on that basis it would collide with equalities law.
And it sounds like German privacy law prevents requesting identity documents (which are, after all, government issue) when not actually required for fraud prevention. Theoretically US law has a similar rule about social security numbers but it's not well enforced.
A while back the UK clamped down on misuse of NI (the equivalent for ss numbers).
I was working for BT at the time and the briefing we got on use of NI numbers was very clear that break these rules and your ass is fired - it was stronger worded than the don't look up the queens private telephone numbers one we had.
And it sounds like German privacy law prevents requesting identity documents (which are, after all, government issue) when not actually required for fraud prevention. Theoretically US law has a similar rule about social security numbers but it's not well enforced.