What else is there to say on this most basic of points? The laws have been published, and there is also official guidance, available online. As I understand it, this condition must be met: "The individual whom the personal data is about has consented to the processing." Obviously you can't fulfil that condition by getting permission from a different person. Unless it's covered by some exemption, which I doubt it is, in general.