There's a problem when "The authority must ensure...", i.e. when there's a lot of discretion granted to "The authority", that's because "The authority" will use any law available to try to silence or harm dangerous individuals when there are "hidden" political reason to do so.
Example: http://www.bbc.com/news/world-europe-39973864
An antidote to this potential abuse is to make laws scarce and highly specific and make judges apply laws in the most textual form possible.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
The authority must ensure that fines imposed in each individual case are effective, proportionate and dissuasive. It will take into account a number of factors such as the nature, gravity and duration of the infringement, its intentional or negligent character, any action taken to mitigate the damage suffered by individuals, the degree of cooperation of the organisation, etc.