Pretty intrigued by this! However, if the data is sold by CC companies, is it truly "public"? Regardless, would you even be able to target an individual without spending lots of money to buy a large batch of "anonymized" spending data?
So anything you could buy would be fine, but no stealing or fraud.