Once we do the KYC, we cannot undo that. My identities are already online and I never know if their 3rd party provider going to sell my KYC info on the darknet or not. I don't know if you are aware or not, but a well-known exchange accepts the claim that their 3rd party partner (who does the KYC process) sells the user information on the internet.
I am not aware, but to be honest, I am also not surprised. I am not sure why the info is worth selling/buying. I mean, I can totally understand that governments may want to surveil bitcoin and, in this effort, they will need to ask KYC exchanges for clients' info. But, who else would be interested in buying them and why? Marketing companies? Or anything more shady?