I think part of what should be considered is that these theoretical corporations who would be buying your transaction history really don't care that much about individuals on an individual level. Big companies such as Target already track everything you buy, even if you don't have some kind of card with them or a rewards program - they track your debit card number as it is used, and record the history of all items. Then they go do crazy things and tell you you're pregnant.

Additional transaction information, such as what you buy at other stores, probably wouldn't be very helpful or informative to them, unless they were considering expanding into other types of businesses or providing other services.

In addition, selling transaction history could potentially violate laws like HIPPA (as it would be possible to see whether you were going to doctor's appointments, especially specialist doctors or psychiatrists) and it would take manpower to scrub the transaction history of those purchases, and I don't think a bank would be willing to invest that much time into a situation like that.

It's a matter of practicability in application - I don't think many corporations would want that information, and I don't think banks would find it profitable to provide it. I also highly doubt it would be legal, but as you believe, there's a wide gap between what banks should do and what they don't do[1] so I encourage you to think about it from terms of practicality and profit. In short I highly doubt it would be a profitable venture for a bank to sell transaction history. In addition, if regulators came across such a process, they would clamp the fuck down on it ASAP.

[1] I have mixed opinions on this but that's not he point of this discussion