[beejiu]

Going slightly off topic, but I find it surprising that GDPR doesn't offer more protections here. The supermarkets are not using consent, but legitimate interest, as the legal basis to process data.

This is surprising because I would think you should be able to opt out of processing/marketing, while still having the loyalty/points aspect of the card. Particularly given non-member prices can be double to triple the price.