1. In the case of breaches referred to in Article 28a, competent authorities shall have the power to impose at least the following administrative measures and sanctions:

(a) a public statement indicating the natural person or the legal entity responsible and the nature of the breach;

(b) an order requiring the natural person or the legal entity responsible to cease the conduct constituting the breach and to desist from any repetition of that conduct;

(c) administrative pecuniary sanctions of;

(i) in the case of a legal entity,

- up to EUR 10 000 000 or up to 5 % of the total annual turnover according to the last available annual accounts approved by the management body; where the legal entity is a parent undertaking or a subsidiary of a parent undertaking which has to prepare consolidated financial accounts pursuant to Directive 2013/34/EU, the relevant total turnover shall be the total annual turnover or the corresponding type of income pursuant to the relevant accounting Directives according to the last available consolidated annual accounts approved by the management body of the ultimate parent undertaking, or

- up to twice the amount of the profits gained or losses avoided because of the breach, where those can be determined,

whichever is higher;

(ii) in the case of a natural person:

- up to EUR 2 000 000, or