$\begingroup$

Well you are making a fundamental misunderstanding about the GDPR (as many have), that consent is the only basis for holding and processing information.

There are actually six legal bases for holding data (you have to scroll down a little as the link doesn't work properly).

Those six bases are:

Consent Contract Legal obligation Vital interests Public task Legitimate interests

So let's look at each of them and see if Santa has any basis for collecting our information.

Consent - Actually this one may not even be as troublesome as it first seems. Presumably we're all writing letters to Santa asking for presents, this could potentially be seen as a form of consent for collecting our data, though I think that's a little iffy.

Contract - The letter to Santa could also form the basis for a contract for the provision of services (present delivery), so I think this works.

Legal Obligation - Unless you want to argue that Santa is legally obligated to perform his duties I don't think this one works.

Vital Interests - No one is going to die if Santa doesn't do his job, probably doesn't work either.

Public Task - I think this is a strong contender. From the website I linked above; "the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law." I would say the worldwide provision of joy and happiness is in the public interest, and the processing of our information is definitely required for Santa's official functions.

Legitimate Interests - This is a little of a grey area and many businesses have used it as the basis for continuing to hold and process information, I see no reason why Santa couldn't do the same.

So in short, there is no real issue at all and Santa can continue doing what he needs to do as long as he properly deals with our information and updates his privacy policies.