I'm not a lawyer but I thought GDPR didn't prevent that. It adds a lot of restrictions on how they can use those emails for how long, but not a complete ban on explicit sharing of emails.
Easily circumventes with a VPN though, most just limit by location, not busy account data.