Identity and documents can be stolen anytime if they are sent for any verification, so I would suggest regular people to stay away from CEX like Coinbase, Binance., etc, or at least be aware of the risks and use them sparingly.
This is very well said, dkbit98! And I hope that my story will help many users to understand
how it really feels to live such drama. I also suggest reading a topic written by 1miau, which is complementary to mine:
Why KYC is extremely dangerous – and useless (I believe that Sarah Azhari, quoted below, will be very interested in reading 1miau's topic.)
your story worries me, if I already have KYC, what can I do now?
Well, first of all you should inform the ones having your personal information that they do not have your consent anymore for processing your personal information. And according to GDPR, they should agree to delete the information they have about you. However, GDPR is recognized only in Europe, therefore if you will address to a company from the rest of the world, GDPR will be useless. If they won't agree, you will have to sue them.
do they really clean up my database KYC if I did cancel my membership or delete my account?
It mostly depends on who is "they". If "they" are a honest business, they should delete your personal information upon your request. The problem is that you may never know for sure if they did it... Furthermore, in case you gave your personal information for something which has a financial connection, then your data will be deleted in 3-5 years (if they will ever delete it)...
I also do not know how to sue them, because like my experience in past, where the Facebook case "Cambridge Analytic", give my KYC on a third party to a consultant company. Until now I don't know how to sue (1 BTC) Mark Zuckerberg because I've already KYC (taken a picture and sent my ID Card) before.
You have to contact a lawyer from your country. I don't know your country laws, nor who you want to sue... But best advice is this: (1) contact the ones having your personal information and let them know that you don't consent to have your data anymore; (2) wait for their answer; (3) if the answer is positive, you can only hope they will actually delete your data; (4) if their answer is negative or if they don't answer at all, then contact a lawyer. You may never know what may happen with your data. And, as you saw in the story from OP, an identity theft is a living hell...
If you wish, you can keep us posted with what progress you made.