Re: Go to the organ grinder..
Sorry, been thinking about this a bit more. The banks (and Facebook and Microsoft) all rely on a consent clause in the contract at the moment. That means that they currently don't believe that the necessity criteria is met (or that there's no harm in requiring consent just in case) even under the UK's more lax interpretation than other EU states.
If that's the case then the necessity justification won't be available post-GDPR either, because nothing much is changing there, and they'll have to rely on one of the others. It's not life or death, there's no public interest, preventing crime is a stretch so there really is only consent or a very optimistic "legitimate interest".
Biting the hand that feeds IT
