GDPR states that direct marketing may be considered to be a legitimate interest. Does this apply to direct marketing by any channel?