Consent was already required to be freely given under the DPD. Agree on the two other points, it seems that GDPR clarified this–I thought it was already covered by the DPD.