As part of just living in.... the world, I already kind of assumed it was possible for some parties, credit card companies in particular, to pry in to my financial activity and also interested governments to compel banks to hand over whatever they had, and/or possibly just hand over everything about everyone to government all the time automatically. This was bad enough, however, even I was surprised and shocked to learn how bad it was with my own bank when they sent me a letter gleefully telling me that as of the date of the letter they had now managed to sell my data to even more 3rd parties. I was not, up until that point aware that they were selling my data at all, and that 3rd parties (other than the credit card company) were getting access to it not just because of powers to compel, like people might expect of governments, but purely because the bank was literally handing it over to whoever was willing to pay for it, no consent on my part necessary. I don't know what changed that required them to apparently have to now disclose this to me, but I assume that they were forced, hence the letter. The sneaky motherfuckers didn't frame it that way though, not "due to recent legislation the bank is obliged to inform you blah blah blah", no just "good news removed, we were selling your data, we still are, but we used to too, and now we're selling it to more people, hope you like egregiously unethical behaviour because we put a travesty in to our travesty so you can experience a travesty while processing the first travesty".