There is a difference between having your data intercepted by statal agencies or by having it intercepted by private entities. The latter would be harder, in absolute terms, to justify.

(And still PSD2 has given private entities accesses to dashboards of financial details of individuals - some of us have not yet understood in which terms.)

Moreover, there is a matter of legal boundaries for each involved agent, and also a matter of a will for those legal boundaries to be actually enforced (as opposed to being expressed as an appeasing veneer).