(1) If the Commissioner is satisfied that a person -
(a) has failed or is failing as described in section 149(2), (3), (4) or (5), or
(b) has failed to comply with an information notice, an assessment notice or an enforcement notice,
the Commissioner may, by written notice (a "penalty notice"), require the person to pay to the Commissioner an amount in sterling specified in the notice.
(2) Subject to subsection (4), when deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commissioner must have regard to the following, so far as relevant -
(a) to the extent that the notice concerns a matter to which the UK GDPR applies, the matters listed in Article 83(1) and (2) of the UK GDPR;
(b) to the extent that the notice concerns another matter, the matters listed in subsection (3).
(3) Those matters are -
(a) the nature, gravity and duration of the failure;
(b) the intentional or negligent character of the failure;
…