Home / Publications / GDPR Enforcement Tracker Report / Individuals and Private Associations

Individuals & Private Associations

In the individuals and private associations sector, DPAs from 15 different countries have so far imposed 202 fines (+106 compared to the 2022 ETR) on private individuals, homeowner associations, individual entrepreneurs, private sport associations and leagues in the total amount of EUR 1,631,796 (+207,050 compared to the 2022 ETR).

Let's take a closer look


  • The highest fine of EUR 525,000 was issued against the Royal Dutch Tennis Association by the Dutch DPA (AP) for selling contact details of 350,000 members without permission to sponsors who contacted them for direct marketing purposes via phone and email (ETid-218).
  • All fines above EUR 20,000 were imposed on sports associations and other big non-profits. Such fines were based on a multitude of violations indicating that DPAs treat big non-profits like businesses.
  • Fines against private individuals were generally much lower, most often below EUR 2,000.
  • The lowest fine of EUR 48 was issued against an Estonian police officer (ETid-384) who accessed personal data in a police database for private research.
  • Many cases against individuals and private associations involve video surveillance on private grounds or in traffic. DPAs imposed fines for such violations regularly even on private individuals.

Main takeaways

The number of fines for this sector has more than doubled compared to the 2022 ETR, while the total amount has increased only modestly. This indicates that many small fines were imposed against individuals. More than half of all fines in this sector were imposed by the Spanish DPA (114), followed by the German DPAs (43).

DPAs tend to treat bigger non-profits (esp. sports associations) just like similarly sized businesses. They imposed fines for various offenses ranging from lack of technical and organisational measures to insufficient information provided to data subjects. 

For individual entrepreneurs and private individuals, the DPAs seem to pay very close attention to the extent to which the violation was foreseeable by the individual and to the motives behind the processing. The number of data subjects and the violator's intention to pursue economic interests through the illegal data processing was particularly important.

Nearly half of all fines in this sector were based on illegal video surveillance (esp. dashcams). This underscores the general focus of DPAs on video surveillance. They consider video surveillance to be such a risky form of processing that strict requirements must be met even by private individuals.