Doesn’t “consent” (point a) supersede all the rest? Looking at how people have been conditioned to so easily click on "I agree", that will be the most obvious thing to pursue for most companies.
You can do more or less anything with the subject's consent, but one of the big changes under the GDPR is that subjects can always withdraw that consent later and then exercise their right to erasure if there is no other lawful basis for that processing.