Receptionist took a copy of my passport

I'm not qualified to answer point 1), but as far as I'm aware, the legal side of this is still the Immigration (Hotel Records) Order 1972 which requires lodgings keepers to record the names and nationalities of their adult (over 16) guests and for "aliens" (which for a couple more weeks means non-EU citizens)

Every such person who is an alien shall also—

(a)on arriving at the premises, inform the keeper of the premises of the number and place of issue of his passport, certificate of registration or other document establishing his identity and nationality; and (b)on or before his departure from the premises, inform the keeper of the premises of his next destination and, if it is known to him, his full address there.

As such they have no legal duty to copy your passport, but I suspect you also don't have a legal right to a bed there without going through the hostel's procedures. Similarly not that much on the average passport is usefully secret, given the number of places it gets taken during travel.

Having said all that, if you wanted to start a legal fight, the first point of reference is probably the GDPR, since they are probably not keeping your data strictly as they ought to.

This happens very often unfortunately. It is easier for the hotel to process your information in this way and after all they are in the hospitality business, not the information security business.

1. One thing you can do when they make a paper copy is ask to cross out the info they dont need like you personal id number, picture, height, etc and write the name of the recipient (hotel) all over the copy. The Dutch govenment has an app that does exactely this, for when companies ask a person for a copy of their document. Maybe something like this is also available to you. Then you could just send them a secure passport copy.
2. They must have your data but they certainly do not have the right to take a picture of your passport and to handle it in such a insecure way by storing a copy on a personal device. At the very least they are not complying with GDPR because they took too much information and they are not handling it securely. However, when you need a place to sleep, you cannot postpone this until you win some expensive legal fight, so the can get away with it. This is also my own experience.
3. I don't know if any cases of identity-theft have been traced back to copies of documents held by hotels but it is always a risk.

The Dutch privacy authority (my poor translation) states that in the Netherlands hotels and B&B's may not copy ID-documents but they are legally required to check your id and record your name and address, type of id, arrival and departure date. In other European countries there may be further requirements.