Only with explicit (not implied) consent, for a reasonable period, only for that legitimate business function, never to be shared with anyone else without additional, optional and specific consent.
Credit reference agencies literally are the only organisation apart from the government to have the last 20 years of my addresses, not to mention pushing that information to organisations that I may well not consent to, not to mention providing little to no reasonable method to correct errors, and also collect far too much information than that necessary for the purpose.
They're gonna be the "big" test of GDPR as soon as all the early test cases build confidence to take them down. My own bank can't hold the information they do, for as long as they do, and I'm a paying customer of theirs - I never consent to Equifax holding or collating that information, seemingly into perpetuity.
Biting the hand that feeds IT
