As commented below: if they do, they are breaking the law, and generally I trust that my bank is GDPR compliant. I have requested insight into the data they have on me and will specifically ask about third parties if I can’t find any information in the data dump.
But yes, they still do have all that data stored. There is no anonymity even if my assumptions about GDPR compliance is correct, but my privacy is in that case better maintained because the number of parties with access to the data is limited. Cash would increase anonymity, but cash only is not really viable where I live anymore.