Example:
How do you ask user for a permission to log access logs (which contain IP address) in the server, so that you can detect spam, ddos and other attacks? How do you store that consent information and what do you do if user doesn't consent?
What do you do if user connecting from given IP address wants you to send him data you have collected about him. If people share IP addresses how do you know which log data is about which person?
Some entity runs a webserver. This entity has a legitimate business purpose in retaining access logs for e.g. 3 months for e.g. spam and security reasons. This entity just has to document that.
This entity can allow a 3rd party service to access these logs so that 3rd party can do whatever needs to be done if it is within the reasons the entity gave for having the data.
What neither can do is go use that data for anything other than the said purposes.
And if the given reasons are gratuitous and somehow the regulators notice, expect to get a nastygram and have to comply or face fines.
Basically what you can't do is collect data for longer than you have a legitimate need for, or cash-in and sell data you've collected. Basically, all said and done, just don't be sleezy and you'll be ok.
Who defines what is a legitimate business purpose?
Let's say I comply with all that, but someone makes a complaint and particularly bitter civil servant judges that the collection is not legitimate, because he doesn't like the content of the website?
That’s like arguing that we shouldn’t have laws in case a cop is having a bad day and follows you around writing tickets. This is a legal process like anything else: your standard should be what you’re comfortable defending in court. Being able to show a good faith decision process, compliance with common industry practice, etc. are going to help the case that any lapse was unintentional.
If your angry ex is hired by a regulator you’d appeal it but there’s no reason to think that’s a common problem.
But appeal might take forever and by the time it is resolved you file for bankruptcy because the fine ruined the cash flow. I've seen in it many times in the EU, for example in Poland. Civil servants are immune from taking responsibility and if you manage to get any compensation you'll find yourself spending years in courts.
> Processing shall be lawful only if and to the extent that at least one of the following applies:
Consent is one:
> the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
Here are all the others (see especially the last one):
> processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
> processing is necessary for compliance with a legal obligation to which the controller is subject;
> processing is necessary in order to protect the vital interests of the data subject or of another natural person;
> processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
> processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
