A large body of case law, well-defined guidelines for evaluating harms and mapping them to fines, and the EU's general fear of stymieing economically productive activity (the motivation behind GDPR is to enable more data trading, not less, but within better-defined legal boundaries).

We have had laws with "open ended" sentencing guidelines since the very beginning of organised society. This is a solved problem.