I'll be honest I'd be suprised if they breached data protection on any of this. Their terms and conditions and privacy notices make it pretty clear what they'll do with you're information. In this particular case they won't be passing anything on to anyone only checking to make sure that you are actually using your ticket.
It's more the host club (eg Bournemouth) supplying data to the Albion that enables the Albion to identify fans and what they've done.
The Albion have fan data and details of tickets sold to them.
The host club have data of what tickets are used to enter the ground and when.
Each of those datasets, independently, do not reveal anything at all.
It's when the host club provide their data to the Albion that the club are then able to know what fans did with their tickets. We've not agreed for host clubs to share data about us in that way.