Unless you're willing to live without credit, legitimate interests will override. Section 6f. This is, in fact, called out as an example in the ICO guidance. That bit doesn't (imo) seem to have materially changed wrt the DPA / Data Protection Directive 95.

Breach notifications are new and interesting though. Equifax definitely would have been required by the gdpr to promptly disclose.

I don't specifically know if EU credit agencies are in the practice of widespread selling of credit data besides when a person has asked for credit. The gdpr will definitely allow opt-out of that (by default even!), but I think previous privacy laws may cover that. I'm not sure.

My personal opinion is the gdpr is probably the end of Acxiom style businesses, plus all the ancillary businesses the CRAs in the United States get up to besides plain credit reports. Eg marketing, wage tracking, outcomes estimation for colleges, etc.