Proportionality is a big concept in EU law, and it's explciitly written in to the GDPR.

Article 83 ("General conditions for imposing administrative fines") states that:

> Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article [...] shall in each individual case be effective, proportionate and dissuasive.

SAs can't just hand out big fines for the sake of big fines. If a fine is issued then the SA's ruling can be challenged on the basis of proportionality.

It can but it doesn't require the fines to be in the millions. AFAIK there are 21 GDPR fines that are in the millions of euro.