[bbbbb5]

> I think GDPR violations are a civil thing only (?).

Correct, however most countries have various related criminal offences. (e.g https://www.legislation.gov.uk/ukpga/2018/12/section/170/ena...) It's extremely unlikely any of these would be relevant in this context though.