Well... no so much in practice. My bank automatically enrolled my personal phone number into the system. I asked them to remove it 2 months ago. One month ago I received a reply that they're working on it. I may be the only person in this country that asked for this - they're now probably thinking which is cheaper: to pay the GDPR fine, repeatedly, or patch their banking software and re-certify it, or maybe refuse to have me as their client.

Anyway, I don't know if you actually read GDPR, but the government (& various agencies) and the bank are both exempted from GDPR. They will all know everything I bought through this system, from where and at what price.