Not to press a point, but there is nowhere that BA is saying that they have consent. The question is under what lawful basis are they using that data. If it's

Not to press a point, but there is nowhere that BA is saying that they have consent. The question is under what lawful basis are they using that data. If it's consent, then where did I consent? If it's not consent, how do I object? Keep in mind that consent is only one of the lawful bases. You never have to get consent to use data. In fact, if you are doing things correctly, you will never need consent. You can't assume that they are using the data under implied consent -- there are lots of lawful bases that they can use instead and they need to explain why they used them.