As you know, the code says specifically that you can object to the collection, use, or disclosure of any personal information that's not required to provide you with the service. In the case of the credit card, what information do they need, how do they need to use it, to whom does it need to be disclosed to provide you with the credit card? When it goes beyond that, when they say when you sign up here we're going to market you, or we're going to release your name to third parties they think you might want to hear from, maybe I don't want to hear from them.
It is covered in the law, so it's a question of educating organizations. And the thing they need to be reminded of constantly is listen to your customer. What does your customer want?