[tremon]

Around here (NL), notorious shoplifters are banned from certain shopping centres. The shopkeepers keep a list with photo's and share it among them. This is established practice (though I'm not sure how widespread) and isn't even considered a GDPR violation as long as the list isn't made public, since protecting yourself from fraud is a legitimate business interest.

Yes, in an ideal world this wouldn't be needed because you could trust the police to handle such cases adequately, but they don't. Hence, where justice fails, you see alternative systems prop up (also see #metoo, cancel culture).