How do companies use my loyalty card data?

Allegations that research firm Cambridge Analytica misused the data of 50 million people has thrust the issue of data privacy into the spotlight.

A huge amount of consumer data is available and - if obtained - is a valuable asset for companies.

And customer loyalty cards, while rewarding shoppers with discounts and deals, are one easy way for companies to collect data on a large scale.

After the launch of Tesco Clubcard in 1995, many stores have followed suit.

Sainsbury's, Waitrose, Co-op, Morrisons, Iceland, Boots and Marks and Spencer are among the retailers which currently offer reward schemes to shoppers.

The average UK shopper owns three loyalty cards, according to research by retail analysts TCC Global.

But how exactly do retailers use the data provided by the cards in your wallet and should you be concerned?

It is well-known that companies use loyalty card data to understand shoppers' habits.

This is not new, and many customers understand this is a core part of the reward card relationship.

Loyalty card data helps retailers understand people's behaviour and then shape it by targeting advertising and organising products to encourage more sales.

In order to get a loyalty card, customers have to register their name, address and date of birth - and sometimes other information.

Scanning the reward card at a shop checkout or entering the card number while shopping online allows companies to track purchases and make a link between people shopping in store and on the web.

It means retailers can create an accurate picture of when, where and how people do their shopping.

Retailers can enrich the data they have collected from reward cards by buying customer data from third-party companies, known as data brokers.

These third-party companies amass information from a variety of sources to create "profiles" of people with information about habits, patterns and personality.

Retailers can then match their loyalty card data to these profiles, producing a clearer picture of shoppers.

All organisations processing personal data must comply with data protection law and each company has a data privacy policy.

"This will include details of what data they can collect, how it can be used, and whether (as well as to whom) the data can be sold on," Dr Garfield Benjamin from the University of Birmingham's centre for Cyber Security and Privacy explained.

"There is an increasing need for greater transparency in this process - we all click 'agree' to lengthy and often confusing terms and conditions without necessarily being able to understand them."

Although stores will often not pass loyalty scheme data to other parties, they may share customers' information with companies within the same group, which can be global.

Some companies may also share the information with their retail partners, who can use it to target their advertising.

Nectar, for example, can share data with at least 49 companies including Argos and Easyjet, according to consumer group Which?

Data protection law is changing from May, when the European Union's General Data Protection Regulation (GDPR) comes into force - changing the way organisations have to look after our personal data.

Campaign group Privacy International said it is concerned about the "hidden data infrastructure".

"Loyalty cards are not a new thing, but the volume of data available to advertisers and companies... combined with the bloated nature of companies vying for access to data is resulting in essentially the mass exploitation of people's data," the privacy organisation said.

It said retailers and third-party companies "hoover up information from a variety of sources" to create profiles, wanting to "know you better than you know yourself".

"This picture of who you are, what your motivations are, who you want to become, can all be used to nudge you to purchase something or even behave in a certain way."

But Prof Paul Longley, who is one of a group of academics working at the Consumer Data Research Centre, said the so-called "big data" can "definitely be used for the social good".

"We hear a lot about invasion of individual privacy and people being manipulated by such sources. But new big data sources can be used for the benefit of all," he said.

"So, for example, we may use smart meter energy data to enable analysis of fuel poverty, or loyalty card data or smart card data to look at how mobile people are around the country."