The amount of the fine is explained in the bulletin you are commenting upon: "The amount of the fine was decided regarding the breaches identified, the number

The amount of the fine is explained in the bulletin you are commenting upon: "The amount of the fine was decided regarding the breaches identified, the number of people concerned, but also taking into account the efforts made by the company throughout the procedure to reach compliance and the fact that its business model is not based on the exploitation of personal data." So evidently there was a dialog with the company during which they remedied much of the fault. Isn't that exactly the sort of approach you'd want from a regulator?