39. Matters to consider when imposing a Penalty

In making a determination to impose an administrative penalty, including the amount as provided in subsection (1) of section 38, the Authority shall have regard to the following matters:–

the nature, gravity and duration of the contravention taking into account the nature, scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;

any action taken by the controller or processor to mitigate the damage suffered by data subjects;

the effectiveness of the data protection management programme required from the controller under section 12;

the degree of co-operation with the Authority, in order to remedy the contravention and mitigate the possible adverse effects of such contravention;

the categories of personal data affected by any contravention;

the manner in which a contravention became known to the Authority, in particular whether, and if so to what extent, the controller or processor notified the contravention to the Authority;

the previous non - compliances by such controller or processor under this Act;

any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, arising out of or in relation to the contravention of this Act by a controller or processor as the case may be.