Those things are not or should not be the same. The existence of the record is inevitably linked to the ability for it to be used in legal actions or criminal

Those things are not or should not be the same. The existence of the record is inevitably linked to the ability for it to be used in legal actions or criminal investigations. However, the ability to use that record for literally every other purpose, and especially for it to be sold for marketing purposes, can be and should be made totally illegal by appropriate banking secrecy regulations. If that's not the case in USA, well, that should be fixable - there are countries in which anyone in the bank doing that would be literally a felony.