This does not only apply to banks. The specific court case was brought against a bank, but the law as is applies to any and everyone who processes your personal data.