First, questions about legality should be directed to https://law.stackexchange.com. As for the rest let's break it down to secret question security and id security:
Using secret questions at all for account recovery has basically been a "deprecated" security step for quite a while. My go to example of why this is a bad idea is the hacking of Sarah Palin's email account during the 2008 US presidential election. The person who accessed her email did so by using the password reset feature in yahoo, which he was able to do because they used secret questions and all of her questions/answers were based on publicly available information about her life.
As a general hint, anytime I do encounter a site that uses security questions, I don't actually answer any of the questions asked. Instead I generate a long random string (which I store in a password manager or what-not) and use that for the answer. Because security questions are based on personal information they are a risk factor primarily for targeted attacks (aka Sarah Palin). As a result using a random string as an answer to a security question means that even if someone knows the middle name of your second grade teacher, the still won't be able to break into your bank account (because you didn't actually answer the question they asked). So whatever you do, if a site is using security questions, treat it like a password and provide a long random string. Also keep in mind that whoever setup the site isn't actually doing security well.
Onto the actual question though: "Is this safe?". Safe is a meaningless term in the security world. Nothing is safe. It is only ever "safe enough for my purposes". From that perspective I probably wouldn't worry too much if they were storing your answers in plain text. The answer to a couple security questions probably won't help an attacker very much because few sites these days still use them and the questions themselves vary from site to site. As a result even if someone got a hold of an answer to a security question of yours on one site you use, they can't just go around gaining access to other accounts of yours like they can if they had found the one password you used everywhere. However, now might be the time to go find all your accounts on systems that have security questions and replace them with gibberish instead of actual answers (or just delete your account since these people don't know what they are doing).
I think you pretty much know the answer to this one yourself, but just to say it out loud: emailing around sensitive PI (personal information) over an insecure channel is definitely a bad idea. In this case though it has the advantage of at least letting you know that they have poor security practices. I used a system once that required me to take a picture of my ID using my computers webcam over a secure HTTPS connection. Sounds good of course (or at least, that's the minimum required to do it well). For all I know though they stored pictures of my id in a public AWS S3 bucket which will later be found by hackers and then splashed across the news (and happens every other day).
I realize that's not much consolation, but since it's quite obvious that having your personal information sent across unencrypted channels is a terrible idea, I figure I might as well try to find some good news. At least now you know that their security is terrible, and you can take measures accordingly - generate and use a unique and long password for this site, change the answers to your security questions to be long random strings, store as little information in their system as you can get away with, and complain loudly to whoever you can about how poorly they are using and storing your data. If you can also confirm that they are storing your data illegally, then you have a whole new slew of people you can complain to, so perhaps something can even be done about it (but I wouldn't hold your breath).