> I think GDPR violations are a civil thing only (?). Correct, however most countries have various related criminal offences. (e.g https://www.legislation.gov.

> I think GDPR violations are a civil thing only (?). Correct, however most countries have various related criminal offences. (e.g https://www.legislation.gov.uk/ukpga/2018/12/section/170/enacted https://www.legislation.gov.uk/ukpga/2018/12/section/170/ena...) It's extremely unlikely any of these would be relevant in this context though.