On: Project Svalbard: The Future of Have I Been Pwned

[DanBC]

> Maybe once he has made some money out of it, a GDPR claim and financial settlement

Do you think GDPR fines go to the person, and not the regulator?

[M2Ys4U → DanBC]

People can sue (Article 79) and claim compensation for actual damages suffered (Article 82) due to a violation of the GDPR.

Administrative fines levied by a supervisory authority generally don't go to people who have had their personal data processed illegally, though.