Honestly all of those are pretty weak cases, the EU needs to start focusing more on on-platform misuse than 3rd party issues.

This particular case is about a third party that scraped data from Facebook, which is incredibly hard to combat since it does not involve any integration with FB.

If they objective is to just make every single profile private then they should just state that already.