Surprising it’s the DPC piping up. They aren’t generally known as an aggressive regulator
They're also quite proactive in offering guidance, material, and feedback. Their cookie sweep from a few years back is something I still reference on a regular basis for the contours of "strictly necessary."
They just don't actually regulate. They offer a lot of guidance and ask a lot of strong-worded questions, but those don't turn into fines.