The rules about registering as a data controller and restricting the use of personal data usually apply to organisations rather than private individuals, so as far as I know, the kind of situation you describe isn't illegal anywhere in Europe. Similarly there are different rules for things like non-profit community groups and the like.

A company doing the same thing, however, might need either the consent of the data subject or a good reason to process or disclose that data without consent. The actual laws cover this in much more detail. But again, this is a tricky issue, because on the one hand there are supposed to be rules about when an organisation is allowed to process personal data in the first place, but on the other hand, the legally enforceable rights of individuals to prevent processing can be quite weak in practice.

In any event, if you were processing data outside the rules, it's highly unlikely you'd wind up with the state coming to arrest you for it. Normally if an individual did object it would be handled via the regulator and you'd have to be a very long way down the path before any sort of police action was involved. I suppose if you completely ignored the regulator's decisions and any resulting fines for long enough, eventually someone would probably see handcuffs.