Not enough. A fine is just a price for people's private data. Companies should never be allowed to transfer private data of citizens to authoritarian countries and should be de-registered and banned from accessing the free world in such case.