The authority must ensure that fines imposed in each individual case are effective, proportionate and dissuasive. It will take into account a number of factors such as the nature, gravity and duration of the infringement, its intentional or negligent character, any action taken to mitigate the damage suffered by individuals, the degree of cooperation of the organisation, etc.
There's a problem when "The authority must ensure...", i.e. when there's a lot of discretion granted to "The authority", that's because "The authority" will use any law available to try to silence or harm dangerous individuals when there are "hidden" political reason to do so.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
The authority must ensure that fines imposed in each individual case are effective, proportionate and dissuasive. It will take into account a number of factors such as the nature, gravity and duration of the infringement, its intentional or negligent character, any action taken to mitigate the damage suffered by individuals, the degree of cooperation of the organisation, etc.