That's not how it works in the UK and not because of GDPR. Currently, organisations can claim both consent and legitimate interests as a legal basis so it is a

That's not how it works in the UK and not because of GDPR. Currently, organisations can claim both consent and legitimate interests as a legal basis so it is already possible to take my data from somewhere, pass it to other people and have those third-parties contact you. "Legitimate Interests" was presumably some attempt to allow things like research and things that hadn't been thought of elsewhere but this leaves a nasty loophole that is already being taken advantage of. In fact, some cookie consent banners, if you click "options", disable the consent tickbox by default but leave "legitiimate interests" ticked in some kind of dark pattern to imply that "we'd rather have your consent but we don't need it".