No, it's not a child abuse or some other violent crime or even drug trading - just protests in France:

> Protonmail responded to this request by providing the IP address and the fingerprint of the browser used by the collective

https://secoursrouge.org/france-suisse-securite-it-protonmail-a-communique-a-la-police-ladresse-ip-de-militant%c2%b7es-anti-gentrification/

I kind of predicted this already in 2014... by merely reading #ProtonMail privacy policy:

https://ipsec.pl/protonmail-security-promise.html