As far as I'm aware, GDPR doesn't make any new prohibitons in this regard - however, it's quite plausible that they were already technically forbidden for years by the earlier data privacy laws, but simply most organizations didn't pay much attention to them.