Does the GDPR cover reviewer blacklists, and if so, how? I've served as an area chair for several conferences.  Following the review period, the program chairs asked the area chairs to submit to them an annotated list of problematic reviewers. Mostly these were reviewers who failed to submit a review at all, despite repeated reminders, but we were also asked to identify reviewers who submitted exceptionally low-quality reviews, such as reviews that were so short/vague as to be useless, and reviews whose factual errors were so glaring that it was obvious that the reviewer either lacked even the bare minimum subject-matter knowledge, or else didn't bother reading the paper at all.  The purpose of collecting these lists was to construct or to supplement a blacklist for use with future program committee invitations.  That is, people on these blacklists would not be invited to review for future conferences operated by the same scholarly society.

I am wondering whether the coming into force of the EU/EEA General Data Protection Regulation has any implications for these blacklists.  In particular, is the blacklist itself considered "personal information", and is it even lawful to compile such a list?  Can the reviewers mentioned on this list use the provisions of the GDPR to force its maintainers to disclose their presence on the list or even to remove them from the list?  How about the area chair comments used to construct the list—are these something that blacklisted reviewers can force the conference organizers to turn over to them?

I realize that this is a question about legal principles and practice, and so might be also (or maybe even better) appropriate for the Law Stack Exchange or a lawyer.  But since the question treats a uniquely academic scenario, I'm hoping that someone here might belong to a scholarly society that has already looked into the matter, and can therefore provide a brief summary for the present academic audience.
The GDPR of course doesn't cover all possible scenarios. However, it's fairly logical. You're not allowed to have and use personal information, unless you meet at least 1 of 6 specific reasons. "Consent" is the best-known, because we've all been asked hundreds of times in the last year. But obviously that's not going to fly for a blacklist.

No, the reason which can justify a blacklist is (6e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Academic publishing is probably not done "in the exercise of official authority", but it definitely is "a task carried out in the public interest".

Having established that there's a reason, most of the other GDPR requirements become technical. There's a right to ask for factual corrections, but if the facts are in dispute you only need to record the objection. You are not forced to decide.

Now the biggy is of course the "right to be forgotten"/right to erasure. This is not an unconditional right. The person invoking this right must state a reason, and this must hold. "Withdrawing consent" is a reason, but it only applies when consent was originally necessary, which is not the case for the blacklist. "No longer necessary" might make sense if someone retires entirely, but we know that in academia retirement is often not a black&amp;white matter.

The good thing here is that you can reason about actual removal requests if and when they arrive. There is not much preparation required other than the general GDPR rules for good recordkeeping.