My understanding is that the data sharing in this case is proportionate to what has been released. I can't see how finding out if you use a ticket or not is an information gathering exercise that compromises anything in the current statutes.
I'm not sure any law has been broken. Where is the evidence of this ?
The club could argue that their enquiry is proportionate. Especially with the illegal sale of tickets.