The bureau suggested this week that states should remove the exemptions banks enjoy from data privacy laws. California is a prime candidate to act.