It should be an assigned/signed device with biometric and passcode access configured... At least it was in a couple proposals I helped define for credentialing emergency responders... though the contract definitely went with a different supplier than the one I was working with.

Palantir isn't collecting it, they are storing it and processing it after it has been collected by ICE.

Their defacto scan everyone isn't to determine citizenship, it is to collect the data in the first place. They want to get as much data into their system as possible.