Practical implications of failing to follow GDPR for online businesses

Question

Suppose a person based in UK has started a one-man business online, for example, a web blog where people can read articles and post comments. Now, the business owner is focused on testing out the business idea, and does not have money to hire a legal consultant just yet. So there are a few GDPR violations on the web blog that don't seem that obvious (or serious) to the naked eye, for example:

• Visitors are not asked to consent to using cookies
• The blog uses a web analytics plugin, that sends customer's IP addresses and locations to a 3rd-party company outside of UK/EU, and the business owner does not sign any additional agreements with the 3rd party
• The website has a very short and generic Terms of Service page that are just copied over from another similar website, and are not using contractual language
• Visitors are allowed to upload images to the web server when they write comments, but are not asked/warned to avoid uploading any illegal/copyrighted content

Now, the business owner has no malicious intent to steal people's data, etc, and there have been no security breaches where hackers could gain access to the data. And there are not many users of the web blog anyway (let's say ~500 people who registered their names and email addresses in the system).

However, it is clear that quite a few GDPR rules are violated here. Of course, in theory, the business owner could face lawsuits, but has this ever happened in practice for violations that are similar to the ones described above? How likely it is that if these violations are detected, the owned is just kindly asked to fix them before any fines/lawsuits follow? What aspects usually affect the likelihood of this?

Answer 1

Such as violator could be subject to a fine, not just to a lawsuit. That is if action is taken by the national Data Protection Authority (DPA).

My understanding is that DPAs mostly concentrate on large businesses and organizations. But it seems that there have been some actions involvign smaller offenders. The GDPR Enforcement Tracker lists enforcement actions.

Listed actions include:

ID	Date	Type	Fine Amt (Euros)	Provision(s)
ETid-1550	2022-12-28	Private individual	600	Art Art. 5 (1) c); Art 13
ETid-1545	2023-01-03	HOA	500	Art. 5 (1) e)
ETid-1536	2022-12-20	Private individual	3000	Art. 6 (1)
ETid-1534	2022-12-20	Private individual	1000	Art. 5 (1) c)

These are just a few recent instances in which individuals or small organizations are shown as having been fined. They show that such consequences do happen in at least some such cases.