Nothing is really “explicit” when it’s buried in pages of small print legalese. If everyone just read (forget understood, just read) everything they ever signed or agreed to thoroughly, life would slow down significantly.
Take a look at a CC application and see where the information on going to a CRA is. I just went to a random online store and started a CC application. Down in the legal section, right in the first couple of sections, clearly visible:
"Credit Reports: You agree that we have a right to obtain a credit report in connection with our review of your application and after we establish an account, to administer the account. You agree that we may report to others our credit experience with you. At your request we will provide the name and address of each consumer-reporting agency from which we obtained a report about you."
Was it plastered across the very top of the form in bold type? No. Was it "buried in pages of small print legalese"? No.
Many CC contracts I have signed (not US or EU banks) have explicit section and additional (mandatory) signature specifically for sharing data with credit reporting company.
The agreements you sign when requesting and getting credit explicitly grant that right.