Can't believe I will defend Facebook but here it goes.

The purpose of a fine is not to bankrupt a company but to be a slap in the wrist to avoid further behaviour. Just like a speeding ticket won't dent my pay check this won't be a blip in the radar of Facebook, but if they continue expect the fines to grow more and more.

I ask again, what would an appropriate amount for a fine be?

Given (ad) revenue is proportional to number of users's data exploited, a variable amount seems fair and yet won't result in bankruptcy. So since you are asking again, how about 1% of annual revenue.