Of course. But they don't do it with the active blessing and support of the legal system.

Again, if you don't understand how your customer's data is being used by a third party, then perhaps you shouldn't use that third party.

Unfortunately, that's easier to say than to respect in practice.

For example, I run a business that allows customers to pay by credit card. There are many parties involved in a single card payment. Obviously at some point along the way there are various checks done to try to reduce instances of fraud. Those almost certainly include automatic decision-making processes that affect my customers.

And yet I don't even know -- and in fact can't know; I asked -- who is making those decisions that might prevent my customer from buying something from me today, nor what basis is used. There is no meaningful right of appeal if my customer or I don't like the decision. In fact, my business can have the money clawed back months after a payment went through apparently successfully and even be fined if one of those payment services up the chain that I still can't identify doesn't like anything for any reason, with no useful explanation given and again no meaningful right of appeal.

This whole arrangement is so totally against the spirit of contracts, money, privacy and data protection rules, and basic common sense that it defies belief. And yet it is absolutely routine: your only alternative as a merchant is not to accept card payments, and your only alternative as a customer is not to have a payment card at all.

The obscurity and lack of information that you complain about, though, is exactly the thing that the GDPR discovery clauses are trying to eradicate. Let's hope that the utterly arbitrary and opaque banking system is held to the same standard eventually.