What the companies said in response

A MARRIOTT spokesman said: ‘We make our guests aware that we collect personal data. Because Marriott is a global organisation ... some sharing of data across borders is essential.’

An Asda spokesman said: ‘We take data protection very seriously and always handle personal data carefully and in line with data protection law.’

A Google spokesman said: ‘We’re continually improving our privacy and security information. We want it to be easy for people to understand and control their data and make the privacy choices that are right for them.’

A Morrisons spokesman said: ‘We do record what customers buy from us and their marketing preferences so that we can provide them with offers and coupons that are useful to them.’

Facebook declined to formally comment, but denied using sensitive data to target adverts at users.

A PayPal UK spokesman said: ‘We share very limited amounts of information with trusted companies to help us provide our services, reduce and protect against fraud and other crimes, and keep our customers informed about our services.’

A Tesco spokesman said: ‘We never sell our individual customers’ personal data, or share it with organisations so that they can use it for their own marketing purposes.’

A BT spokesman said it used customer information to provide services but credit reports did not form part of their profiles.