I think (and I'm not terribly informed here) that the difference would be that Capital One has a business relationship with Chipotle, albeit somewhat indirect. Polling customers while otherwise being unrelated to the company is different from mediating payments to the company and using that data.

According to the article, the big problem here was that the data being used here belonged to Capital One, and these researchers were running their own thing on the side using that data.