Not when they err on the side of making them too low.
Then you get the problem of (hypothetically) “Yeah, BMW compromised everyone’s information ... but we took into account how much our country/state depends on them and gave a slap on the wrist.”
Like the VW case.
Edit: or does the EU allow third parties to sue over too-low fines? That would be a surprise.
