Home / Publications / GDPR Enforcement Tracker Report / Individuals and Private Associations

Individuals & Private Associations

This chapter covers any fines imposed on private individuals, homeowner associations, individual entrepreneurs, private sport associations and leagues.  DPAs imposed 96 fines (+66 compared to the 2021 ETR) for the total amount of EUR 1,424,746 (+567,150 compared to the 2021 ETR). These fines were issued by DPAs in 15 (+6 compared to the 2021 ETR) different countries.

Let's take a closer look


  • The highest fine of EUR 525,000 was issued against the Royal Dutch Tennis Association (ETid-218) for selling contact details of 350,000 members without permission to sponsors who contacted them for direct marketing purposes via phone and email.
  • All fines above EUR 20,000 were imposed on sports associations and other big non-profit organisations. Such fines were based on a multitude of violations indicating that DPAs treat big non-profit organisations like businesses.
  • Fines against private individuals were generally much lower, for the most part below EUR 2,000.
  • The lowest fine of EUR 48 was issued against an Estonian police officer (ETid-384) who accessed personal data in a police database for private research.
  • Many cases against individuals and private associations involve video surveillance on private grounds or in traffic. DPAs imposed fines for such violations regularly even on private individuals.

Main takeaway

The total sum of fines for this sector has nearly doubled compared to the 2021 ETR. The largest number of fines were imposed by the Spanish authority (44), followed by the German authorities (23).

DPAs tend to treat bigger non-profit organisations (especially sports associations) just like similarly sized businesses. They imposed fines for various offenses ranging from lacking technical and organisational measures to insufficient information provided to data subjects. 

For individual entrepreneurs and private individuals, the DPAs seem to pay very close attention to the extent to which the violation was foreseeable by the individual and of the motives behind the processing. The number of data subjects and the violator's intention to pursue economic interests through the illegal data processing was particularly important.  

Nearly half of all fines in this sector were based on illegal video surveillance (especially dashcams). This underscores the general focus of DPAs on video surveillance. They consider video surveillance to be such a risky form of processing that even private individuals must meet strict requirements.