That's exactly the angle that PUP is taking. I believe that as a framework it is compatible with the GDPR, but it assumes different guidance that offloads less responsibility to people. Consent should be a red flag, not a catch-all.
♥ 1