This was/is unclear, I actually remembering having an hour long discussions about this exact topic several months ago. This is the biggest problem with the GDPR it was hard to understand what could and could not be done.