There are certain things that you should stay away from. Unless you have explicit consent or are otherwise explicitly permitted, you are not allowed to do any of the following processing activities, considered high-risk activities:

• Processing of special categories of data. This includes data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
• Perform profiling of data subjects such that automatic decisions are made that have negative consequences (in a legal sense) for the data subjects. You can grade people and reward the people the algorithm finds are good. But you are not allowed to punish the bad.

• Monitoring publicly accessible areas on a large scale. You need a special permit to be the big brother...

If you are at risk of exposing data subjects to a high risk, you must perform a Data Protection Impact Assessment (DPIA). If such an assessment concludes there is such a high risk, you must consult with authorities, who will euphemistically give you advice on the subject. I suggest you follow that advice. It is not called advice because it's optional for you to do anything. It is called advice because you can do something else, if you can show it is better. They still have their eyes on you and can give you any number of sanctions if they find you're doing something you shouldn't be.