Every now and then my CEO writes something that makes real sense.
Not all the time, but certainly this time.
At the core of the GDPR is transparency. If you store information on Jane, you need to tell her about it. End of discussion. We can argue about “Consent” or “Legitimate Interest” and as a result “Opt in” or “Opt Out” but, at the most basic level, Jane has the right to know. Moreover, she has the right to ensure that you keep her data up to date.