Article 87. General conditions for imposing fines

(1) The Centre shall ensure that the imposition of fines in accordance with this Section in respect of the infringements provided for in art. 88 is in each case effective, proportionate and dissuasive.

(2) Depending on the circumstances, fines shall be imposed in addition to, or instead of, the measures referred to in art. 60(2)(a)–(h) and (j). In the case of a minor infringement, or where the fine likely to be imposed would constitute a disproportionate burden on a natural person, a warning may be issued instead of a fine. For the purpose of imposing a fine and determining the amount of the fine, the following circumstances shall be taken into account in each individual case:

1. a) the nature, gravity and duration of the infringement, taking into account the nature, scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;
2. b) whether the infringement was committed intentionally or negligently;
3. c) any action taken by the controller or processor to mitigate the damage suffered by the data subject;
4. d) the degree of responsibility of the controller or processor, taking into account the technical and organisational measures implemented by them pursuant to art. 25 and 32;
5. e) any relevant previous infringements committed by the controller or processor;
6. f) the degree of cooperation with the Centre in order to remedy the infringement and mitigate the possible adverse effects of the infringement;
7. g) the categories of personal data affected by the infringement;
8. h) the manner in which the infringement became known to the Centre, in particular whether, and if so to what extent, the controller or processor notified the infringement;
9. i) where measures referred to in art. 60(2) have previously been ordered against the controller or processor concerned with regard to the same subject matter, compliance with those measures;
10. j) adherence to codes of conduct approved in accordance with art. 40 or to certification mechanisms approved in accordance with art. 42; and
11. k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.

(3) Fines may be imposed only if it is established that the controller has committed an infringement provided for in art. 88 intentionally or negligently.

(4) If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Law, the total amount of the fine shall not exceed the amount specified for the gravest infringement.