Would Facebook and Cambridge Analytica be in Breach of GDPR?

Aside from the ethics of what Facebook and Cambridge Analytica allegedly did with user data, there's the question of its legality, particularly under the General Data Protection Regulation, which goes into effect next month for companies doing business in the EU.