The data can be packaged into tranches and sold on to multiple buyers. Those buyers can then sell that data on again to other buyers. The victims have lost complete control of their own personal data and both they and their families have to deal with the negative consequences for the rest of their life, or longer.
That's why casinos should be transparent and always make it clear that they intend to do KYC. If users knew that their funds can be blocked if they don't submit documents, many wouldn't deposit anything because KYC is still a grey zone. It's that line many of us don't want to cross. Casinos know about it and they will obfuscate their rules and regulations to make people play and they'll start demanding KYC when a user wins some money. As long as people lose money, there's no KYC and everything is good.
IMO that's abuse and casinos that do it should be avoided.