Which is why in new legislation, fines are proportional - GDPR has fines at max 4% of global yearly revenue or 100 million euros, whichever is higher.
Then of course there's the fact that the GDPR - possibly due to a bit of regulatory capture - very strongly encourages venue shopping, and with resources like that, bending a small venue (like Ireland) to your will even slightly is conceivably feasible, and valuable. Personally, I'm not too impressed by the implementation of the GDPR, even if the fact that it's finally on the agenda is a good thing. It may even exacerbate misuse of personal data, because the burdens it imposes are much harder to bear for small parties than for large ones; and that's a competitive moat that encourages centralization of private data, and that encourages shifting the balance of power toward the corporation away from the individual (who says no to google's privacy policy?), and the combination of "willing" users, a lax privacy policy, and huge centralization encourages misuse. Proportionally your local sports-club is likely more impacted than Google, which is absurd.
In other words, laughably low.
> or 100 million euros
Unless you're a small business, in which case they'll happily bury you.
If it's not going to be imprisonment, then the fines need to be much quicker, and much higher; enough to threaten a corparation's viability. For some perspective the largest fine/court settlement in the past few years is VW US's, which was 37 billion, and vs. a tech firm the 2012 FTC settlement with facebook at 5 billion. EU's largest antitrust fine ever (vs. google in 2017) was just 2.4 billion. Those kind of costs are so low that they're unlikely to be preemptively discouraging, especially given how rare they are; alphabet's revenue in 2020 was 180 billion, and it's market cap is a little less than 10 times that.
Of course absurd fines that are rarely imposed are more like a reverse lottery than anything else; not exactly ideal either, really.