Consent isn't the only grounds for processing, though.