GDPR will govern more than just permission to communicate with EU consumers. It will also influence how companies use data collected from EU citizens and limit their ability to use personal data for multi-channel marketing.
Simply put, GDPR requires companies to clearly identify the “specific use” a piece of information will serve. While the exact definitions around specific use are still gray, experts recommend that companies select and declare specific uses for any and all data collection.
For example, student loan provider might request an email address specifically for loan payment reminders. A financial services company might seek a birth date in order to make an investor aware of change-of-life effects to insurance or other financial products.
Regardless, GDPR prohibits the collection of personal data for one purpose (loan payment reminders) and its use in other purposes (email marketing).
Specific use definitions will likely be clarified in court as early challenges and violations come to light. In the meantime, consider your intended uses and declare them clearly at the point of collection.