Well unless it was stored with freely given permission of course.

But it has to be freely given. "Give permission or you can't use this service" is not ok for data that isn't required to provide the service.

It must be freely given anyway, but its still illegal to keep unless proportional and necessary for the stated purpose.

If the purpose wasn't "we keep to resell it later" it's likely illegal.

Well, "illegal" given that this type of criminality is pretty much ignored (I've been fobbed off by the regulator after pointing a systematic law-breaking by a $company many many many times. Still better than not having this).