If Paypal pays service provider Y to validate a credit card hasn't recently been used in fraud, they would be sharing the data, but they certainly wouldn't be selling the data.