ASA targets shop data privacy practices