You can do more or less anything with the subject's consent, but one of the big changes under the GDPR is that subjects can always withdraw that consent later a

You can do more or less anything with the subject's consent, but one of the big changes under the GDPR is that subjects can always withdraw that consent later and then exercise their right to erasure if there is no other lawful basis for that processing.