The scenario is that a potential buyer audits random records to validate that checks are/were handled ok and the data that must be preserved for KYC audits actually is. This isn’t “selling your data to potential bidders” (if they are bidders there is no sale presumably?) so not sure why you are reading into it such intent.

Pretty sure selling your passport pic is illegal, as far as name, address and IP all major banks are doing this already.