A’ 137/29.08.2019 GOVERNMENT GAZETTE assistance insofar as necessary in order to implement this Chapter. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out consultations, inspections and investigations. 2. The Authority shall take all appropriate measures required to reply to a request of another supervisory authority for mutual assistance without delay and no later than one month after receiving the request. 3. The Authority may refuse to comply with the request: (a) if it is not competent for the subject matter of the request or for the measures it is requested to execute, or (b) compliance with the request infringes the law. 4. The Authority shall inform the requesting supervisory authority of the other Member State of the results or, as the case may be, of the progress or the measures taken in order to respond to the request. In the case of the previous paragraph, it shall justify its refusal to comply with the request. 5. The Authority shall, as a rule, supply the information requested by the supervisory authority of the other Member State by electronic means and in a standardised format. 6. The Authority shall not charge a fee for actions taken pursuant to a request for mutual assistance, unless it has agreed with the supervisory authority of the other State to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances. 7. Requests to the Authority for assistance shall contain all the necessary information, including the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested. SECTION VII LIABILITY AND PENALTIES Article 80 Liability of the controller (Articles 54 and 56 of the Directive) A public authority, in its capacity as a controller, having unlawfully caused damage to the data subject, in breach of the provisions of Articles 6 to 8 or the provisions of this Chapter, shall be required, in accordance with the provisions of Articles 105 and 106 of the Introductory Law to the Greek Civil Code, to pay compensation or damages for non-material damage to the data subject. Article 81 Criminal penalties (Articles 54 and 57 of the Directive) Article 38 shall also apply to the processing of personal data by competent authorities for the purposes of Article 43. Article 82 Administrative penalties (Articles 54 and 57 of the Directive) 1. Without prejudice to the supervisory powers of the Authority pursuant to Article 15 of this Law, the Authority, in a specific reasoned decision and following a previous 3401 notice summoning the interested parties to provide explanations, may impose the following administrative fines on competent authorities for infringements of their obligations as data controllers: (a) for infringements of Articles 6 to 8 and Articles 60 to 78, an administrative fine of up to one million euros (EUR 1,000,000), (b) for infringements of Articles 45 to 57, an administrative fine up to two million euros (EUR 2,000,000) and (c) for failure to comply with an order of the Authority under Article 15(4), an administrative fine of up to two million euros (EUR 2,000,000). 2. When deciding whether to impose an administrative fine and determining its amount, in each individual case due regard shall be given to the following: (a) the nature, gravity, duration of the infringement, scope or purpose of the processing concerned and the number of data subjects affected by the breach and the extent of the damage suffered, (b) any actions taken by the competent authority to mitigate the damage suffered by the data subjects, (c) any relevant previous infringements by the competent authority, (d) the categories of personal data affected by the infringement, (e) the manner in which the infringement became known to the Authority, in particular whether, and if so to what extent, the competent authority notified the infringement and (f) in case the measures referred to in Article 15(4) have already been ordered against the competent authority with regard to the same infringement, the degree of compliance with those measures. CHAPTER E FINAL AND TRANSITIONAL PROVISIONS Article 83 Transitional provisions 1. Reference to Law 2472/1997 made in provisions of the legislation in force shall be construed as reference to the relevant provisions of the GDPR and of this Law. 2. The guidelines and regulatory acts of the Authority shall remain in force, provided that they do not infringe the GDPR and the provisions of this Law. 3. The staff serving at the Authority at the time of passing this Law, both permanent and under an employment relationship governed by private law, shall be automatically assigned to equivalent positions governed by public or private law for each category, branch or specialty, in accordance with their formal qualifications. 4. Requests pending before the Authority until 25.5.2018 will be filed without further action following a declaratory act of the President with the exception of data subjects’ admissible applications. Article 84 Repealed provisions Law 2472/1997 on the protection of individuals with regard to the processing of personal data shall be repealed,