Good point also, scam projects can sell your data to third part, so we should be careful on how and where we submit our KYC information.
It continues to absolutely amaze me how willing people are to send their documents to a
completely unknown entity. You have absolutely no idea who you are sending your documents to - you have no way of knowing if the person is who they say they are. It is trivially easy to launch an ERC20 token and set up a website and a bounty campaign. Almost anyone can do it. And given that the vast majority of ICOs are scams, you are almost certainly sending your documents to a scammer/criminal.
Having your identity stolen is no laughing matter. It can ruin your life. Financially, you will spend months talking to police, banks, etc. trying to get it all cleared up, and even then, it can take years for you to repair the damage done to your credit, all the time being unable to get credit for anything - house, car, credit cards, even mobile phone contracts. Criminally, you can end up with a criminal record you didn't know you had and being summoned to court for crimes you didn't commit. You can have your driver's license suspended and be fired from jobs for things you didn't do.
I won't even participate in a KYC for an exchange. There are not enough tokens in the world to make me willing send my documents to a stranger.