There was no invasion of privacy. Your credit card company has the right to know what you purchase. Given that most credit cards have terms and conditions that differentiate between gift cards and, say, toilet paper, for the purposes of giving rewards and charging interest and fees, you have no legitimate expectation that what you purchase is kept a secret from your CC company. Your HIPAA example does not work; it would be a very specific exemption.