Balancing privacy and public interest in the fight against illicit financial flows: lessons from an European case study