in EU, the legal statement or at least a privacy policy is mandatory. It doesn't matter if there is a legal entity or not : in case of lawsuit it's the owners who will be targeted it can be an organization or individuals.
This being said, not having such a statement is not a problem. If someone had the weird idea to fill a case without serious infringement, it will be rejected or it will be treated with the lowest priority and the legal delays would be expired before a court would have look at the case.
