[zucan]

> Collecting PII is NOT illegal, as far as I can see. Nor can it be illegal.

Article 6 [0] is phrased negatively, making collecting PII illegal unless x or y. These points cover all the use cases the lawmakers deemed valid; a real-estate agent may collect PII because of 6.1b (taking steps to enter a contract at the request of the data subject). Should a new, possibly valid reason to collect PII come up it would first need to be checked and then added to the list.

Since most websites and online services do not aim to form a contract nor fit points c-f, they have to obtain consent by the data subject (6.1a) to make collecting PII legal.

[0] https://gdpr-info.eu/art-6-gdpr/

[Silhouette]

Since most websites and online services do not aim to form a contract nor fit points c-f, they have to obtain consent by the data subject (6.1a) to make collecting PII legal.

Many common purposes for data processing might come under point f (legitimate interests) depending on the circumstances. Analytics, marketing, monitoring to check for fraud or other abuses are just a few examples.

[alfredallan1]

Doesn’t “consent” (point a) supersede all the rest? Looking at how people have been conditioned to so easily click on "I agree", that will be the most obvious thing to pursue for most companies.

[Silhouette]

You can do more or less anything with the subject's consent, but one of the big changes under the GDPR is that subjects can always withdraw that consent later and then exercise their right to erasure if there is no other lawful basis for that processing.