The exchanges can offer your kyc docs to government structures if those will ask for. Regarding the selling docs, I think reputation cost more that docs.
Yes, but what if the exchange doesnt care about its reputation? Perhaps such an exchange can sell data to third parties. We live in the 21st century, in which everything is possible! And to categorically deny the fact that some kind of exchange can sell data is ridiculous.