Ireland’s Data Protection Commission (DPC) just announced it is fining Meta €265 million (US $276 million) for GDPR non-compliance due to data scraping. This brings Meta’s 2022 total fines from the DPC to almost €700 million. The DPC oversees the company because it is headquartered in Ireland. And, reports are that more Meta fines may be announced there soon. This fine was for a 2021 breach that affected more than a half million records and resulted in personal data surfacing on a public forum and circulating widely on the web.

Citizen Labs’ new report adds to criticism of Canada’s pending (and long-titled) Bill C-27: An Act to enact the Consumer Privacy Protection Act (CCPA), the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act. Bill C-27 is an update to the Personal Information Protection and Electronic Documents Act (PIPEDA), which has been in force as federal law for two decades. Among the concerns raised is that the new CCPA law would be weaker than GDPR and that it includes problematic exemptions, including that organizations can decide when benefits of collecting of personal information outweighs risks - and that this could be done without having to notify people of collection or planned use.