You may only use collected PII data to either fulfil legal obligations you have either as a data controller or toward the data subject, or for the purpose stated when receiving consent for data collection.
The data subject can under certain circumstances (see article 18) stop you from using their PII data. In these cases, you must be able to make sure that the data is retained in your systems but not used. (Of course, the data subject cannot stop you from using data in cases where you are legally obligated to pass on PII data to authorities for example.)
Last updated: Jun 19, 2018