On: Project Svalbard: The Future of Have I Been Pwned

[M2Ys4U]

People can sue (Article 79) and claim compensation for actual damages suffered (Article 82) due to a violation of the GDPR.

Administrative fines levied by a supervisory authority generally don't go to people who have had their personal data processed illegally, though.