GDPR is addressing precisely these things though, and tightening up the allowed actions. It doesn't really matter if it was previously allowed, you need explicit documented consent to store PII.

But, I thought it wasn't coming in to force until next May.