Maybe so but what here really would've prevented this? The information involved is necessarily public: bank details and credit card numbers need to be shared otherwise why have them?
Writing a rule that says the government can't do this is just the government writing a rule it can simply remove it ignore when inconvenient.