Member States shall ensure that when determining the type of administrative sanctions or other measures and the level of administrative pecuniary sanctions, the competent authorities take into account all relevant circumstances, including where appropriate:
(a) the gravity and the duration of the breach;
(b) the degree of responsibility of the responsible natural or legal person;
(c) the financial strength of the responsible natural or legal person, as indicated by either the annual income of the responsible natural person or the total turnover of the responsible legal person;
(d) the importance of profits gained or losses avoided by the responsible natural or legal person, in so far as they can be determined;
(e) the losses for customers and third parties caused by the breach, in so far as they can be determined;
(f) the level of cooperation of the responsible natural or legal person with the competent authority;
(g) measures taken by the responsible natural or legal person to prevent
…