The only way to implement this practically would be to store your tasklists in a database (eg. MySQL) and have the db not return the financial information for unauthorised users.
The DB would also have to have converters to and from a tasklist.
A few years ago I half-wrote a generic storage plugin for accessing a database by ODBC but only with limited success.