under what circumstances can a bank ask for sensitive info such as IC number, account number, credit card number through an email reply?

that day CIMB issue two same credit card (same name, same number) which is a breach of personal data protection act as what if another copy of the card reach other people?

so i escalated the case to higher management, and now the higher management reply my email by asking for my sensitive info. the email is not the CIMBclick email but my personal gmail.

can i raise this issue to bank negara?