but the argument I have nothing to hide except bank account passwords etc is hard to argue with
It’s simple to argue against: any and all data points are either potential threat vectors, or will in aggregate paint a better picture of the individual they pertain to, for the data’s possessor to use as they wish. A default-deny policy for data creation/access makes as much sense for individuals as it does workplaces.