[hericium]

A person can sue a company that broke GDPR against this person, in a civil case, after GDPR body rules that the company indeed broke the law against this person.