I've served as an area chair for several conferences. Following the review period, the program chairs asked the area chairs to submit to them an annotated list of problematic reviewers. Mostly these were reviewers who failed to submit a review at all, despite repeated reminders, but we were also asked to identify reviewers who submitted exceptionally low-quality reviews, such as reviews that were so short/vague as to be useless, and reviews whose factual errors were so glaring that it was obvious that the reviewer either lacked even the bare minimum subject-matter knowledge, or else didn't bother reading the paper at all. The purpose of collecting these lists was to construct or to supplement a blacklist for use with future program committee invitations. That is, people on these blacklists would not be invited to review for future conferences operated by the same scholarly society.
I am wondering whether the coming into force of the EU/EEA General Data Protection Regulation has any implications for these blacklists. In particular, is the blacklist itself considered "personal information", and is it even lawful to compile such a list? Can the reviewers mentioned on this list use the provisions of the GDPR to force its maintainers to disclose their presence on the list or even to remove them from the list? How about the area chair comments used to construct the list—are these something that blacklisted reviewers can force the conference organizers to turn over to them?
I realize that this is a question about legal principles and practice, and so might be also (or maybe even better) appropriate for the Law Stack Exchange or a lawyer. But since the question treats a uniquely academic scenario, I'm hoping that someone here might belong to a scholarly society that has already looked into the matter, and can therefore provide a brief summary for the present academic audience.