It depends on the data. If we are talking about private protected financial records, this is not true. Federal law prevents sharing this data with government in wholesale, whether the government purchases it or not.
To be fair, there are a lot of things that are not "private protected financial records." Anything reported to a credit bureau is up for grabs. Its been this way for a very long time. A number of other data points as well. Ever sign up for shopping rewards somewhere? Have an account at sportsmans warehouse or Basspro? Fill out a "free drawing raffle ticket?" They all sell your name, address, phone number, email address, and any other contact information to data conglomerates like IDIcore, who then sells subscriptions to their searchable database to debt collectors, private investigators, law enforcement, etc.
Bank statements pointing out that you made a purchase at Midwayusa so the government can do roundups of people who bought gun parts? Those cannot be distributed. BUT... nothing prohibits Midwayusa from sharing their sales records, so you still aren't "safe."