Furthermore the GDPR does not apply to small-scale, ad-hoc, personal situations. Contacting a CEO as a customer is fine. Your personal phone's address book is fine. So is keeping a list of attendees of your birthday party. But wearing a camera on your body all day and recording everything and running face recognition on the video, even if you do it for personal reasons, is not ok.
With the original article, it's obvious that he's written a lot of CEOs. How many is too many? What if it were a couple of thousand?
> It may be the most appropriate basis when: > you cannot, or do not want to, give the individual full upfront control (ie consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.