Actually, they are horribly afraid of getting sued for privacy violations. Not that anyone would win but the directors involved get a big black eye if anyone had data and it wasn't cleared through legal.

They got dragged into a class-action lawsuit involving credit data before my time and thus everyone in the marketing organization is very careful to follow the rules. Unlike the big banks, they don't view fines and lawsuits as 'cost of doing business'.