Lost my phone without GPS & data plan on
Question 1

Theoretically not possible for an ordinary thief - it is enough of a deterrence. If the thief stole it from you, with an express international of gaining access to that data and he has sophisticated tools at his disposal, then you need to be worried. But going by your description, it is unlikely. There are also other factors involved, which you can see in this SE.Security question Is Android's Password Screen Lock Enough Data Theft Protection?, which explains in detail how it is possible for a determined person

In security parlance Physical possession is ownership is often said, but that's the worst case scenario

Question 2

Sorry to say but there is nothing you can do, till the thief chimed to internet and device is wiped.