>2When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
> any action taken by the controller or processor to mitigate the damage suffered by data subjects;
>the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;
>the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;
>where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;
>any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.
So, a whole bunch of very explicit things that are to be used when deciding if whether to impose a fine (at all).
Says who? The only perfectly clear parts of the GDPR revolve around the massive fines.
https://www.theguardian.com/business/2017/jun/27/google-brac...
Shocking stuff.
Except the Commission actually gave Google quite detailed advice over 5 years earlier about what it needed to do to be compliant.
https://www.ft.com/content/564a284a-a334-11e1-8f34-00144feab...
The agencies that can enforce the GPDR want you to be compliant, not to fine you... If you're actually working towards compliance past evidence shows they won't fine you.