And if you didn't have to give consent, you can object to your data being used anyway. They then have to give a credible reason that counters your objection. I mean, technically the law says you can only process data iff you have a purpose for it and must delete it when you no longer have an immediate purpose for it so I don't really get why there is a separate provision for this, but we all know how this goes (you don't make money by deleting data so nobody is on top of it) so I'm happy that provision is explicitly mentioned. (Disclaimer: besides IANAL, I'm also not actually sure if this was in the text of the law or if this was on the local regulator's site.)