Of course I know, these things are regulated separately. Sure, my bank could share it illegally but they could already have done that even without mandatory recording.
> Worse, that data can be hacked and leaked to the internet.
As could my fiscal declaration, my bank statement or all records of my transactions with any sellers.
I personally am fine with my state mandating that large transactions between individuals have to be recorded for fiscal purpose in the same way that I'm fine with it imposing accounting standards to corporations and asking people to fill tax declarations.
You're personally fine, until your transactions are posted to the internet along with the address to where you live. Period.
As for the regulation, things like the recent GDPR helped a little - if you are an EU citizen, you can now legally request them to provide a list of the time someone accessed your details. I recently did that with a financial provider and had a very unpleasant experience when I found out who they share the data with - basically companies and institutions I've never heard of, like credit score providers & other financial information data mining companies.
There is basically no privacy for transactions above 1000€.
Worse, that data can be hacked and leaked to the internet. Eg. Criminals will be able to see that last summer you bought an expensive watch, and know that you may be a good target. Such data has often been leaked to the internet before.
There was a recent incident where the sales data for the Ledger cryptocurrency hardware wallet was hacked and leaked to the internet. Including names and addresses of people. I guess this stort of stuff will happen more frequently in the future.