3390 GOVERNMENT GAZETTE GDPR, the offender shall be punished with imprisonment of at least one (1) year and a fine of up to one hundred thousand euros (EUR 100,000), unless the act is punishable with a more severe penalty under another provision. 4. The person who has committed the acts referred to in the previous paragraphs shall be punished with incarceration of up to ten (10) years, if he or she intended to secure for himself or herself or others an unjust profit, or cause financial loss to another person, or cause damage to another person, and the total profit or total loss exceeds the amount of one hundred and twenty thousand euros (EUR 120,000). 5. If the acts referred to in paragraphs 1 to 3 have resulted in a risk to the free functioning of democracy or national security, they shall be punishable with imprisonment and a fine of up to three hundred thousand euros (EUR 300,000). 6. The felonies provided for in this Article shall fall within the jurisdiction of the three-member court of appeal for felonies. Article 39 Administrative sanctions 1. Without prejudice to the Authority’s corrective powers in accordance with Article 58(2) of the GDPR, the Authority may, in a specific reasoned decision and following a previous notice summoning the interested parties to provide explanations, impose to bodies of the public sector, as this is defined in indent (a) of Article 14(1) of Law 4270/2014 (Government Gazette A’ 143), with the exception of public undertakings and bodies referred to in Chapter A of Law 3429/2005 (Government Gazette A’ 314), in their capacity as data controllers, for infringements relating to: (a) indent (a) of Article 83(4) of the GDPR, with the exception of Articles 8, 27, 29, 42, 43 of the GDPR, (b) Article 83(5) and (6) of the GDPR, with the exception of Articles 17, 20, 47, 90 and 91 of the GDPR, (c) Articles 5, 6, 7, 22, 24, 26, 27 (with the exception of paragraph 7 thereof), Articles 28 to 31, and indent (a) of Article 32(1), Articles 33 to 35 of this Law, an administrative fine of up to ten million euros (EUR 10,000,000). 2. When deciding whether to impose an administrative fine and determining its amount, in each individual case due regard shall be given to the following: (a) the nature, gravity and duration of the infringement taking into account the scope or purpose of the processing concerned, as well as the number of data subjects affected and the level of damage suffered by them, (b) any action taken by the body of the public sector to mitigate the damage suffered by data subjects, (c) any relevant previous infringements by the body of the public sector, (d) the categories of personal data affected by the infringement, (e) the manner in which the infringement became known to the Authority, in particular whether, and if so to what extent, the body of the public sector notified the infringement and (f) where measures referred to in Article 58(2) of the GDPR have previously been ordered against the body of the public sector, with regard to the same infringement, the A’ 137/29.08.2019 degree of compliance with those measures. 3. If a body of the public sector, for the same or linked processing operations, infringes several provisions of the GDPR or of this Law, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. Article 40 Judicial remedy against a controller or processor 1. Actions brought by a data subject against a controller or processor for breach of data protection provisions within the scope of the GDPR or the rights of the data subject referred to therein shall be brought before the civil courts in whose district the controller or processor has his or her establishment. The actions referred to in the previous subparagraph may also be brought before the civil courts in whose district the data subject has his or her habitual residence. 2. The previous paragraph shall not apply to actions brought against public authorities, where such authorities exercise sovereign power conferred on them. 3. Where the controller or processor has designated a representative in accordance with Article 27(1) of the GDPR, the representative in question shall be considered to be a procedural representative for the serving of all documents carried out in the framework of civil proceedings pursuant to paragraph 1. Article 41 Representation of a data subject 1. Where the data subject considers that the processing of personal data relating to him or her infringes the provisions of the GDPR or Chapter III of this Law, he or she shall have the right to mandate a not-for-profit body, organisation, association or a not-for-profit group of persons without legal personality which has been properly constituted and is legally established in the Greek territory, has statutory objectives which are in the public interest and is active in the area of protection of data subjects' rights and freedoms with regard to the protection of their personal data, to lodge a complaint on his or her behalf with the Authority in accordance with Article 77 of the GDPR, and to exercise on his or her behalf the rights referred to in Article 78 of the GDPR and Article 20 of this Law. 2. The representation mandate referred to in paragraph 1 shall be made by means of a specific written authorisation validated for the signature authenticity of the contracting party in accordance with Article 11(1)(a) of the Code of Administrative Procedure (Law 2690/1999, Government Gazette A’ 45). The mandate may be revoked at any time, in whole or in part. Article 42 Public access to documents 1. The application of the provisions of Article 5 of the Code of Administrative Procedure relating to the provision of documents by bodies of the public sector falling within the scope of Article 1 of the above Code and of other provisions relating to the issuing of documents by the body