What I don't understand is how a document I unwillingly sign (because you can't get a credit card if you don't) giving the bank permission to share my data with, say, Equifax then gives Equifax the right to aggregate and resell my data, not even just share it but actually sell it. I haven't checked, but it probably says something like "for the bank and its business partners to use in any way required for business purposes ". I'd love to see a privacy lawyer take this on .... most consumers had no idea what we were agreeing to.