GDPR regulates the processing of personal data excluding processing activities by a natural person in the course of a purely personal or household activity. Other processing activities of natural persons are regulated by GDPR and can be fined.
But that does not mean that individuals cannot be fined. In Germany, someone paid a fine of 2,620 EUR for sending a rage e-mail to 160 people in CC instead of BCC. This mail is considered a publication and not a “data processing in the personal or family area” and is therefore subject to the GDPR.
In Austria, individuals are fined EUR 330 for using a dash cam, which was justified by the fundamental rights of data subject according to GDPR.