1. The European Data Protection Supervisor may impose administrative fines on Union institutions, bodies, offices and agencies falling within the scope of this Regulation. When deciding whether to impose an administrative fine and when deciding on the amount of the administrative fine in each individual case, all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following:
(a) the nature, gravity and duration of the infringement and of its consequences, taking into account the purpose of the AI system concerned, as well as, where appropriate, the number of affected persons and the level of damage suffered by them;
(b) the degree of responsibility of the Union institution, body, office or agency, taking into account technical and organisational measures implemented by them;
(c) any action taken by the Union institution, body, office or agency to mitigate the damage suffered by affected persons;
(d) the degree of cooperation
…