From this post on Facebook, Agoda (and its sister site Booking.com) saved his credit card information and shared it with the hotel he had chosen.
My friend also shared the same experience when she stayed in Myanmar, when she wanted to extend the stay, the hotel's staff pulled the paper with all of her credit card information to charge her additional cost.
Is this practice common in booking services?
Second question (should this question be moved to Law SE?). From what I read in Information Security SE, those services aren't allowed to save this information (I will link to IS SE later). Can we do anything to prevent this practice?