Nearly a million passports and photo IDs were unprotected on the public internet

This sounds exactly like how LLMS mess up.

So as well as having your details leaked, you're implicated as a consumer od cannabis.

It will be interesting to see. If you look at the GDPR fines record (well at least the last time I did) spain stands out for its frequency and size of fine.