Huge difference between one person's documents in your pocket and a million documents on a web site. The latter is a huge target for hackers.
"the [MtGox] hacker also have access to a 20GB data dump of customer data along with passport scans"
https://bitcointalk.org/index.php?topic=498522.msg5485610#msg5485610Uploading your personal data to any web site is inherently dangerous and should only be done with great caution and only when absolutely necessary. I never uploaded my documents to MtGox (thankfully) and stopped using the site when they started requiring them, for exactly this reason. I had no legal concerns whatsoever about the source of funds in my MtGox accounts at all (they were all solo mined coins) but I did not trust them with my personal information.
Indeed we see that those exchanges who ask for documents, should get their ass handed to them if they fumble those docs. Fiduciary responsibility means what? Or at least, it should.
Exchanges, traditionally, are vectors of far more crime, then honesty. I mean, Jesus had to bust one up with full force, and even then, he didn't affect the money system of Earth, it is still fiat debt based on wars.
But you are so right to point out that the people who claim responsible positions, need to carefully protect whatever info they intake from the public.
If you cannot keep data secure, well, frankly, you should have known you were too stupid to ask for it in the first place. That is how I feel. I would never ask for people's data if I knew it would be pilfered. At the end, only creditability and integrity will matter.