An important additional component of the GDPR is that an individual can revoke their consent, and require all previously collected personal information be deleted.

https://www.gdpreu.org/the-regulation/key-concepts/consent/

https://www.gdpreu.org/the-regulation/list-of-data-rights/ri...