If they don't, and if privacy is important to the buyer, no information should be disclosed until the seller agrees to and implements appropriate policies and procedures. When the seller is unwilling or unable to do so, the buyer must decide whether its privacy preferences or the transaction is more important and act accordingly. Note that this applies even to nonfinancial transactions such as Web surfing. The easiest way to protect privacy is by not disclosing information in the first place. This applies just as much to Web surfing as it does to financial transactions.
Common sense plays a role here, too.
Even when privacy protection has been reviewed and approved, there is still no need to disclose more information to the seller than is required by the transaction. Requests for superfluous information should be challenged. If there's no legitimate need for the information, it should not be provided. After the transaction is completed, the buyer still has a right to privacy. The seller's side Sellers' number-one privacy concern should be to respect their customers' privacy.