Proportionality is a big concept in EU law, and it's explciitly written in to the GDPR. Article 83 ("General conditions for imposing administrative fines") sta

Proportionality is a big concept in EU law, and it's explciitly written in to the GDPR. Article 83 ("General conditions for imposing administrative fines") states that: > Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article [...] shall in each individual case be effective, proportionate and dissuasive. SAs can't just hand out big fines for the sake of big fines. If a fine is issued then the SA's ruling can be challenged on the basis of proportionality.