From what I've seen, it's partially like in the US - each EU member has its own data protection authority which imposes those fines, but they are closer linked than the US states' laws. I can definitely see some EU countries slacking off on enforcing, or being less/more harsh than the others.