While the bank obviously made a monumental screw up, Google's initial response to the bank is at least in part to blame. Regardless of the privacy rights of the person who's Gmail account it is, there obviously should be an interest in protecting the confidential information of the 1,300 customers.

Google could have responded by helping the bank recover and delete the file, as well as sending an unmissable notification to the Gmail user.