Loyalty cards are a means for stores to carry out largescale data collection to track our habits and behaviours.
The GDPR says that consent must be “freely given, specific, informed and unambiguous”. Is it consent when there is an imbalance of power, as in the case of supermarket loyalty schemes?