Better would be to fine any public company a percentage of their market cap or something comparative that matches the fine to the size of the company.
That would provide a true penalty that discourages large multi-nationals from abusing local laws.
An even more useless measure against Google was made earlier last year (2013) by the Information Commissioner's Office (ICO) in the UK (a data privacy body).
Google, having wrongly collected wi-fi data during its Street View activities, was asked to delete the private data it had collected. It failed to do so, prompting the ICO to give them additional days to comply with deletion but no fine. [1]
Google probably have an entire department of corporate lawyers zealously protecting their interests, yet despite being instructed by an official body to delete private data, they "accidentally" retained the discs containing the additional private data. These are not the actions of a compnay that takes privacy seriously. And that is unlikely to change until official authorities sufficiently hold Google to account for their privacy transgressions.
I agree (and I'm pretty sure the CNIL agrees) it's not enough.
As a French, I see the CNIL as some kind of Superman of the citizens rights. When Superman fight against someone, this someone is probably evil.
If the fines are this small, it's pretty clear that the legislators who passed this law were not interested in creating a serious deterrent.
It's cleared the European Parliament and is currently being stymied in the Council (the body made up of ministers from EU member states)
The income from the local market comes to mind, as this is realistically the piece of the cake that the local government has some control over.