GDPR definition of consent:
(11) 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
=> Article: 6, 7, 8
=> Recital: 32, 33, 38, 42, 43
=> Dossier: Consent
In a recent GDPR session I attended (having nothing to do with impact to religious institutions) one of the facilitators made the comment that when it came to "special" or "sensitive categories" of data, GDPR's bar for what qualified as "consent" was much higher. She said (paraphrasing) that when it came to religion, race, etc. data, "consent" would require more than simply implied consent. Even a "check the box"/"I agree" would not be sufficient to serve as "consent". Additionally, it was mentioned that the consent given had a shelf life-- that GDPR would expect the controller of the data to seek renewal of that consent at least every 5 years.
If what I heard was correct, the WT's current privacy policy's definition of consent comes nowhere near meeting the bar set by GDPR.