To my knowledge card purchase data (on an individualized level) isn’t sold to data brokers or even reported to credit bureaus. Aggregated and (barely) anonymized? Sure. The ability to request a full list of transactions someone does with just their social? This is a totally different level of crazy.