I get the impression it's not forbidden in the UK. Here's the equivalent page from MasterCard. [0] (Incidentally, the captcha is broken so the page is unusable.)
> To opt-out from our anonymisation of your personal information to perform data analyses
The page is super vague, and the question remains if they can fully anonymise the data, but if they can, it's allowed. Personal data is covered under the GDPR, while anonymous data isn't [0].
In the UK there are data science groups at banks that target specifically extremely wealthy customers based on their transactions and balances. I think that they only focus on wealthy customers right now because they haven't scaled up properly but the plan is to eventually expand to everyone.
This has happened since banks started selling investment products, wealth managers simply pull up a list of cash heavy accounts who haven't opted out of marketing where they can push investment products. Think is biz model private bankers and 'Wealth Management' arms at banks are built upon
