Fines for data protection breaches: how serious does the breach need to be?