[anonymouz]

Maybe we just misunderstood each other a bit: My point about the 'federal crime' is not to judge gambling as more nefarious, but to simply point out that the violated law in this case is a completely different type of law (criminal).

As you correctly note, the GDPR is an EU regulation that will be enforced by national regulatory bodies through warning letters and fines. Unlike for criminal offenses, there simply is no way for it to be enforced by a police force or through arrests.