Does the GDPR cover reviewer blacklists, and if so, how?
The GDPR of course doesn't cover all possible scenarios. However, it's fairly logical. You're not allowed to have and use personal information, unless you meet at least 1 of 6 specific reasons. "Consent" is the best-known, because we've all been asked hundreds of times in the last year. But obviously that's not going to fly for a blacklist.

No, the reason which can justify a blacklist is (6e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Academic publishing is probably not done "in the exercise of official authority", but it definitely is "a task carried out in the public interest".

Having established that there's a reason, most of the other GDPR requirements become technical. There's a right to ask for factual corrections, but if the facts are in dispute you only need to record the objection. You are not forced to decide.

Now the biggy is of course the "right to be forgotten"/right to erasure. This is not an unconditional right. The person invoking this right must state a reason, and this must hold. "Withdrawing consent" is a reason, but it only applies when consent was originally necessary, which is not the case for the blacklist. "No longer necessary" might make sense if someone retires entirely, but we know that in academia retirement is often not a black&amp;white matter.

The good thing here is that you can reason about actual removal requests if and when they arrive. There is not much preparation required other than the general GDPR rules for good recordkeeping.