Due to the close links between credit cards and banking, the Tournier principle -- based upon the famous 1924 legal court case of Tournier v National Provincial and Union Bank of England -- is usually applied by credit card issuers when handling their customers data. The Tournier principles has four cornerstones:
Applying the Tournier principle to the real world examples, some common circumstances where credit card companies will share data are:
As you'd expect, due to the liability that banks/credit card issuers face if they breach confidentiality, they will not share personal data willy-nilly with third parties. Credit card companies should only share data with trusted business partners such as credit reference agencies, and, when they are required to disclose data to regulatory/governmental agencies/authorities. Credit card companies may employ third party companies to process and administer services: during an application for a new card, then these third party companies may access data to manage, validate or administrate an application. Sharing data to verify an application would probably fall within stage four of the Tournier principle: "When a banks own interests dictate that disclosure is required."
Update January 2018: As of the 13th of January 2018, a new initiative has been launched which is called open banking, which has compelled the big banks to 'open' up access to customers data (Allied Irish Bank, Bank of Ireland, Barclays, HSBC, Lloyds, Nationwide, RBS, and Santander). The open banking rules are being administrated by the Financial Conduct Authority, and are based upon the EU's Payment Services Directive II (PSD2). The idea behind open banking is that it will allow consumers to access their data, share it with other financial companies, who can then use this data to more accurately tailor their services to new customers. This is also hope -- according to Which? -- that open banking may improve competition and result in better deals for the consumer. Customers can opt out of open banking -- it would appear that customers have to opt-in and give content to enter into open banking -- but, it is too early to conclude how each bank will handle 'open banking'.