They aren't allowed to use that data for *anything else*, and as soon as they've finished, they must delete your data. You can also revoke their access to your data at any time, for any reason, with one click - none of this "call a customer service rep and wait on hold" nonsense.
What's more, if your bank has *any* doubts about a request for your data, they are empowered to (temporarily) refuse to provide it, until they confirm with you that everything is on the up-and-up.
17/