[orwin]

And you are allowed to take it to the european court if you think the fine is bullshit. And if you don't already know, european court don't take bullshit very well.

Anyway, all regulatory instances are working together (in a group named G29, imagination is not their strength) to draw guidelines for fines and warnings. They will also discuss together ongoing cases (to avoid multiple prosecutions i guess). If you are not trying to cheat data from your customers and if your security is up to date, you risk nothing.