I'll take the question on the GDPR.
The GDPR refers not to sensitive information, but to special categories of personal data. Those special categories, in article 9 of the GDPR, refer to:
...racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation....
Those are the categories in the GDPR. As Mr. Schaan said, financial data is not on the list of sensitive information for the GDPR.