Most airlines use a 'clip-on' system to collect APIS. i.e. their systems were not designed around the collection of passport (and other information) but it was added on at a much later date. Often the APIS information is not interfaced with the PNR data - they are linked but not to the extent that the airline can 'see' and use passport information. Of course privacy laws, which differ in every jurisdiction, do limit how the data can be held and used.
There is no IATA standard. They have gotten out of the business due to competition law concerns.