They don´t need to double-check data with your local authorities, of course.. it´s all about compliance.. any serious ico should delete files inmidiatelly after review.
None of them delete any info, some of them even sell or use these info.
There are too many fake ICO's, some have only this purpose, to collect ID data and use/sell for various reasons.
I said "serious" ICO.. check the cost to run any decent ICO in terms of marketing, developers, advisors, exchanges, etc.. i doubt the reward of selling some kyc´s could cover just a small portion of it all... but if you see a low profile ICO, with red flags and low budget asking for your passport, then it´s probably not a good idea to apply...