Sorry friend, but consumer protection laws do not include extortion clauses. You entered into an agreement with them, and if you read the fine print, that agreement included language that they can and will take whatever actions, and make whatever changes, they feel necessary to run/improve/stay legal with their business.

The chances of your State Attorney General doing anything other than filing your complaint in the round file are exactly zero. It's a company based in Japan, doing business through the internet exchanged hypothetical tokens of value that have no corporeal existence. They are offering at least as secure a protection scheme for your documents as your state driver's license agency, probably safer, they have a stronger vested interest in protecting your data than either your state or federal taxing authorities, and have less than a fraction of a percent of the exposure that your bank, your doctor and dentist, stock broker, credit card company, landlord, school, mortgage lender, selective service bureau, post office automobile dealership where you purchased a car or any police department that has stopped you for a moving violation; yet every one of those entities saw, and probably photocopied your identification documents. And most of them are keeping them in electronic form, on servers that are about as secure as Paris Hilton's virtue.

Send them your id. Add a specific statement that you will hold them liable for any data loss of breach of the security of your information, and demand that they destroy all traces of that document when you stop doing business with them.