In case you're referring to the General Data Protection Regulation, it does not apply until May 2018. The penalty that would be applied would probably be this one, given that the number of prior offenses, the gravity and duration of the offense, the number of affected users and the damage caused, etc. need to be taken into account:

> Each supervisory authority shall have all of the following corrective powers:

> [...]

> (b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(IANAL)