The law explicitly lists factors the regulators have to take into account for determining the fine. If they give a large fine for a small infringement, they're going to have a hard time to claim they took all factors in your favor in account properly.

From what I've seen, it's partially like in the US - each EU member has its own data protection authority which imposes those fines, but they are closer linked than the US states' laws. I can definitely see some EU countries slacking off on enforcing, or being less/more harsh than the others.