Agreed, but there are differences between the GDPR per members country, for example, in the Netherlands we are not free to use data derived from people that specifically said their data would be usable for science (data like tumor gene expression values). You need to ask for consent again. Or if you can't, you need to prove you can't and then you need to publish everything you derive from the data. This is different in the UK.