Suppose a person based in UK has started a one-man business online, for example, a web blog where people can read articles and post comments. Now, the business owner is focused on testing out the business idea, and does not have money to hire a legal consultant just yet. So there are a few GDPR violations on the web blog that don't seem that obvious (or serious) to the naked eye, for example:
- Visitors are not asked to consent to using cookies
- The blog uses a web analytics plugin, that sends customer's IP addresses and locations to a 3rd-party company outside of UK/EU, and the business owner does not sign any additional agreements with the 3rd party
- The website has a very short and generic Terms of Service page that are just copied over from another similar website, and are not using contractual language
- Visitors are allowed to upload images to the web server when they write comments, but are not asked/warned to avoid uploading any illegal/copyrighted content
Now, the business owner has no malicious intent to steal people's data, etc, and there have been no security breaches where hackers could gain access to the data. And there are not many users of the web blog anyway (let's say ~500 people who registered their names and email addresses in the system).
However, it is clear that quite a few GDPR rules are violated here. Of course, in theory, the business owner could face lawsuits, but has this ever happened in practice for violations that are similar to the ones described above? How likely it is that if these violations are detected, the owned is just kindly asked to fix them before any fines/lawsuits follow? What aspects usually affect the likelihood of this?