The programmability of CBDC, at least in the EU doesn't seem to be anywhere on the agenda, so those fears are probably highly exagerated. Given the digital EURO will allow offline transactions, the restrictions people talk about are probably pure speculation.

Commercial banks all do overcompliance, so there is no environment where they would refuse to provide information when asked, so I do not see them as safe harbours for my data.