[semigroupoid]

Article 83 in general and specifically Art. 83 (2) state that "the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement" should be taken into account when determining penalties. We'll have to see what this means in practice though.

[newman8r]

I wonder if their definition of 'should' is in line with RFC 2119 https://www.ietf.org/rfc/rfc2119.txt

I know nothing about European legal systems though

[stordoff]

The GDPR doesn't use "should"; it states that "[w]hen deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to" that factor. Basically, if you can show that they _didn't_ take that into account, or that you tried to cooperate and were stone-walled, you will have good grounds for having the fine overturned.