As I read it, credit card details etc are currently being supplied but meal details are not. See here.

It's a fascinating distinction, and I can see much debate and legal argument about why one type of data is appropriate to collect but not the other.