Yes, it is.
You might be aware that the Commissioner revised this recommendation in a subsequent letter in September. He corrected or revised his sixth recommendation, which is about his role as ombudsman. In revising that sixth recommendation, he stated that Recommendation 5, to which you refer, would no longer be necessary.
That said, let's go back to the starting assumption, which forms the basis of your excellent question. There are precedents on the subject. For example, in Europe, privacy commissioners have the power to impose fines. There is therefore a monetary amount, even for government institutions that violate privacy.