Yes but that's a necessity to support lawful contracts between a person and an organization e.g. a loan provider. The data subject, as I think, is the owner. T

Yes but that's a necessity to support lawful contracts between a person and an organization e.g. a loan provider. The data subject, as I think, is the owner. They have rights over how and when their data is used & e.g. have a right to be forgotten. They do not, however, always have the power to exercise their 'full' rights in cases where they've entered a binding contract. Such as trying to exercise the 'right to be forgotten' with a company who provided a loan they've defaulted on. They do however have the right through law to instruct the controller to use the data in the bare minimum ways they need to reasonably execute the contract. A reasonable data protection legislation needs to side with the controller in some situations else it would be otherwise incompatible with modern society / law. It certainly does help more than harm imo, especially when it comes to marketing / advertising.