> I bet all are tracked and cross-referencable with the requestor

In theory they are not. The individual store is supposed to keep a paper record of the sale and the background check result so that they can be audited, but that is meant to be the only record.

Of course who knows what is being done to illegally capture the data.