This has already happened with GDPR... remember the credit unions are private companies, not government outfits.