I've been suggesting that fines should be proportional to the type of data they request and how much.

So the more you collect, the more you stand to lose in a data breach. That should do 2 things:

1) Encourage companies to do "least data collection" (a good thing)

2) Strengthen their security if they do any sort of non-trivial data collection