My questions are 1) how is this legal, and 2) what kind of agreement was forged with the credit card providers to make this possible?
Of course it is legal. Credit card companies have had agreements in place to share information like this for years. In some cases it isn't anonymized either. Acxiom[1] is probably the best known company working in this area.
[1] http://www.nytimes.com/2013/09/01/business/a-data-broker-off...