Current T&C have following wording around marketing and third party companies:
16.7. We will process, use, manage, control, release and record information about you to:
(…)
16.7.4. contact you by post, by phone or in another way about other products and services which we consider may interest you – unless you tell us that you prefer not to receive direct marketing;
16.8. We may reveal information about you:
(…)
16.8.7. to anyone you authorise us to give information about you to.
I may not be an expert on legal stuff, but it’s really clear. Legally, users we will receive marketing opt out - and it might be more user-friendly than usual banks, my gut feeling. 
Legally, I have to agree to have my data shared with third party. There are probably many bad things that happen to companies that break the law, including, but not limited to ICO fines. 