I don't really have a problem with requiring consent to work with personal data. Right to be forgotten is restricted and I can't think of obvious cases within the restrictions here: https://ico.org.uk/for-organisations/guide-to-the-general-da... that I disagree with.

Stronger restrictions on what data you can hold without good reason or consent means that inevitable breaches become less important.