When determining the amount of a fine, supervisory authorities must consider:

• A.Only whether it is a first offense, per Article 9(1), which classifies ordinary employee payroll and contact details as special categories of personal data
• B.Only the controller's revenue, per Article 58(2)(i), which requires supervisory authorities to obtain judicial authorisation before imposing any administrative fine
• C.Only the number of affected data subjects
• D.The nature, gravity, and duration of the infringement, the intentional or negligent character, actions taken to mitigate damage, and degree of cooperation