We have encrypted face biometry and fingerprints on them, but no retina. None of the countries I have visited required my retina scan, either.

In the older versions, some data was unencrypted, and most encryption was optional, and someone built a passport scanner and made a talk. I remember that some heads are proverbially rolled and some specifications are updated.