The Network and Information Systems Regulations 2018

PenaltiesU.K.

18.—[F1(1) The designated competent authority for an OES may serve a notice of intention to impose a penalty on the OES if it has reasonable grounds to believe that the OES has failed to comply with a duty referred to in regulation 17(1) or the duty set out in regulation 17(3A) and considers that a penalty is warranted having regard to the facts and circumstances of the case.

(2) The Information Commissioner may serve a notice of intention to impose a penalty on a RDSP if it has reasonable grounds to believe that the RDSP has failed to comply with a duty referred to in regulation 17(2) or the duty set out in regulation (3A) and considers that a penalty is warranted having regard to the facts and circumstances of the case.]

(3) A [F2notice of intention to impose a penalty] must be in writing and must specify the following—

(a)the reasons for imposing a penalty;

(b)the sum that is [F3intended] to be imposed as a penalty and how it is to be paid;

(c)the date on which the notice [F4of intention to impose a penalty] is given;

[F5(d)the period within which a penalty will be required to be paid if a penalty notice is served;

(e)that the payment of a penalty under a penalty notice (if any) is without prejudice to the requirements of any enforcement notice (if any); and

(f)how and when representations may be made about the content of the notice of intention to impose a penalty and any related matters.]

[F6(3A) The relevant competent authority may, after considering any representations submitted in accordance with paragraph (3)(f), serve a penalty notice on the OES with a final penalty decision if the authority is satisfied that a penalty is warranted having regard to the facts and circumstances of the case.

(3B) The Information Commissioner may, after considering any representations submitted in accordance with paragraph (3)(f), serve a penalty notice on the RDSP with a final penalty decision if the Commissioner is satisfied that a penalty is warranted having regard to the facts and circumstances of the case.

(3C) The relevant competent authority or the Information Commissioner may serve a notice of intention to impose a penalty or a penalty notice irrespective of whether it has served or is contemporaneously serving an enforcement notice on the OES or RDSP under regulation 17(1) or (2).

(3D) A penalty notice must—

(a)be given in writing to the OES or RDSP;

(b)include reasons for the final penalty decision;

(c)require the OES or RDSP to pay—

(i)the penalty specified in the notice of intention to impose a penalty; or

(ii)such penalty as the relevant competent authority or the Information Commissioner considers appropriate in the light of any representations made by the OES or RDSP and any steps taken by the OES or RDSP to rectify the failure or to do one or more of the things required by an enforcement notice under regulation 17(3);

(d)specify the period within which the penalty must be paid (“the payment period”) and the date on which the payment period is to commence;

(e)provide details of the appeal process under regulation 19A; and

(f)specify the consequences of failing to make payment within the payment period.

(3E) It is the duty of the OES or RDSP to comply with any requirement imposed by a penalty notice.]

(4) A competent authority or the Information Commissioner may withdraw a penalty notice by informing the person upon whom it was served in writing.

(5) The sum [F7of any penalty imposed] under this regulation must be an amount that—

(a)the competent authority or Information Commissioner determines is appropriate and proportionate to the failure in respect of which it is imposed; and

(b)is in accordance with paragraph (6).

(6) The amount F8... must—

(a)not exceed £1,000,000 for any contravention which the [F9NIS] enforcement authority determines [F10was not a material contravention];

F11(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c)not exceed £8,500,000 for a material contravention which the [F12NIS] enforcement authority determines [F13does not meet the criteria set out in sub-paragraph (d)]; and

(d)not exceed £17,000,000 for a material contravention which the [F14NIS] enforcement authority determines [F15has or could have created a significant risk to, or significant impact on, or in relation to, the service provision by the OES or RDSP.]

(7) In this regulation—

[F16(a)“a material contravention” means—

(i)[F17a failure to take, or adequately take, one or more of the steps required under an enforcement notice within the period specified in that notice to rectify a failure described in one or more of—

(aa)sub-paragraphs (a) to (d) of regulation 17(1); or

(bb)sub- paragraphs (a) to (d) of regulation 17(2); or

(ii)where an enforcement notice was not served or where no steps were required to be taken under an enforcement notice, a failure described in one or more of—

(aa)sub-paragraphs (a) to (d) of regulation 17(1); or

(bb)sub-paragraphs (a) to (d) of regulation 17(2).]]

F18(b). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .