The way the GDPR works is a little bit different. There are six bases for processing data, consent being one of them. Legitimate interest is another, and lawful authority as well. I would assume that lawful authority would be defined nationally because, of course, the GDPR applies to all European member states and they would have their own jurisprudence and legislation that define lawful authority. I can't really speak to that.
This is something that's very specific to the Canadian law enforcement and criminal law context. I think a better reference would be the Supreme Court of Canada.