Carrefour got a spicy +3M€ fine in November 2020.
You can find a non-exhaustive list here (FR) > https://www.nextinpact.com/recherche;q=cnil%20amende
Also, GDPR applies as long as the company runs a business in EU. It doesn't matter where the company is originally from. They will be more than happy to fine the french entity if it made sens. Instead, they fine the Irish entity that performs social dumping. Not bad.