art_64__para_2

2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, enforcement measures referred to in Article 63(3) and (4). Health data access bodies shall decide whether to impose an administrative fine and the amount of the administrative fine in each individual case by giving due regard to the following circumstances: the nature, gravity and duration of the infringement; whether any penalties or administrative fines have already been imposed by other competent authorities for the same infringement; the intentional or negligent character of the infringement; any action taken by the health data holder or health data user to mitigate the damage caused; the degree of responsibility of the health data user, taking into account technical and organisational measures implemented by that health data user pursuant to Article 67(2), point (g), and Article 67(4); any relevant previous infringements by the health data holder or health data user; the degree of cooperation of the health data holder or health data user with the health data access body as regards remedying the infringement and mitigating its possible adverse effects; the manner in which the health data access body became aware of the infringement, in particular whether, and to what extent, the health data user notified it of the infringement; compliance with any enforcement measures referred to in Article 63(3) and (4) which have been ordered previously against the controller or processor concerned with regard to the same subject matter; any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained or losses avoided, directly or indirectly, through the infringement.

← art_64__para_1 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-15 · Text as adopted (Official Journal); later amendments are not incorporated in this text.