The only way to have privacy in finance is Monero or cash. These financial institutions essentially live in the twentieth century, have every incentive to collect as much data about you as possible, little incentive to protect it or delete it, and terrible security practices.
I'm fully aware that the first thing a regulatory body will do, whether I go via the Financial Conduct Authority because they're a bank or the Information Commissioner's Officer because they misused my personal information, is tell me that I need to complain to the bank first and give them a chance to respond. So I have: I complained on the day that post went live, and they told me that they're looking into it and will get back to me within 8 weeks.
THEN we'll see about a complaint to the regulator! :-)