It's not a minimum.
Nothing in the GDPR states this. It's obviously the intent, but ultimately it's left up to the bon vouloir of EU regulators.
It is perfectly legal under the GDPR to make an example out of you by levying the maximum fine for a first offense, and without warning.
No it isn't. Read Article 83.
[0] https://ec.europa.eu/newsroom/just/document.cfm?doc_id=47889
You'd have to be a consistant repeat offender, with no effort made at remediation, with no cooperation with the regulator, and probably handling sensitive or financial data.
Here's a list of recent actions taken. I think the current maximum fine is £500,000. Have a look through a few of these hopefully it's somewhat reassuring.
When I read things like this I realize how many companies are not treating user data as they should. Protecting user data should already be built into the company software and process.
Given FB revelations and additional scrutiny to Google, I see some form of this law coming to the US.
Which means in practice that if x other people have been fined around y for an offense similar to yours, your fine has to be in the vicinity of y. Ditto if x people have been fined more for larger offenses or less for smaller. This kind of assessment is routine. General. It's not something that needs to be written into each and every law.
