You postal code, name and the expiration date on your card is enough to positively ID you in many consumer databases, and by giving it to the retailer you're implicitly granting consent for its use for this purpose.
I am not a lawyer, but I'm pretty sure that in Canada, this would be in violation of the federal "Personal Information Protection and Electronic Documents Act", as well as many provincial laws.
"Use or disclose personal information only for the purpose for which it was collected, unless the individual consents, or the use or disclosure is authorized by the Act."
"Keep personal information only as long as necessary to satisfy the purposes."
If the client uses one of those "points" cards, yes, they are tracked, but otherwise they shouldn't. When a retailer asks for your postcode, it is mostly just for market study to identify where their clients live, but that's it (although I rarely get asked). You can also just answer "no thanks" to this question.