Who's to say that 10% of the maximum for a minor violation isn't proportionate? Also, most small businesses do not have the resources to hire competent counsel on the other side of the planet to litigate these things.
A large body of case law, well-defined guidelines for evaluating harms and mapping them to fines, and the EU's general fear of stymieing economically productive activity (the motivation behind GDPR is to enable more data trading, not less, but within better-defined legal boundaries).
We have had laws with "open ended" sentencing guidelines since the very beginning of organised society. This is a solved problem.
I'd cynically add:
> and to prevent people from killing and robbing each other each day
There's a reason we have Wikipedia articles like this one:
The tendency of people to follow laws has shown little relation to blunt enforcement. It has to do with peoples tendency to follow norms.
Again, people are assuming that this is the first and only directive that has fines associated with it. It isn't. You don't hear a lot of people talking about the three month prison sentences possible for CE marking, for example - because very few of them have been handed out and only for egregious violations such as unsafe machinery that has caused injury.