Just a side note in relation to the title, EU institutions are not subject to GDPR.

They are instead subject to the similar Regulation (EU) 2018/1725 of the European Parliament and of the Council.

Much smaller administrative fines among other things.

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15525770...

However, the linked article discusses not EU government/institutions but rather EU member states public authorities web sites. Such web sites are subject to GDPR but each member states decides whether administrative fines should be possible to impose on public authorities (and if so their max amounts) according to GDPR Article 83(7).