Re: Should result in summary judgement...
"if I apply to a bank for credit they can acquire, store and retain data necessary for the provision of that credit. If that bank has a separate contract with an advertiser to provide email addresses of anyone applying for credit then the necessity exception doesn't apply there."
Which is what Experian and friends have been hoping you wouldn't notice for a long time.
Up until GDPR the only way to stop them selling your data to advertisers was an explicit DPA section 11 notice and they used all kinds of scare tactics to dissuade those including "this may affect your credit rating" (which they also used to frighten people into not being on the closed electoral register)
These "credit rating agencies" actually make more money selling your data to marketers than they do from their supposed core business, so it's going to be interesting to see how many prosecutions result from GDPR breaches as they scramble to make up lost income by ignoring the laws.