S.L. 330.20 Art. 8The Authority’s powers to impose administrative penalties and other administrative measures.

(1) Without prejudice to any other power of the

Authority conferred to it under the DORA Regulation, the Act or any regulations issued thereunder, including these regulations, where the

Authority is satisfied that a person’s conduct amounts to a breach of any of the provisions of the DORA Regulation, the Act, these regulations, or of any regulations or Rules made thereunder and implementing the provisions of the DORA Regulation, or otherwise that a person has contravened or failed to comply with any condition, obligation, requirement, order or directives made or given by the Authority under any of the provisions thereof, including failure to cooperate in an investigation or an on-site inspection, the Authority may, by notice in writing and without recourse to a court hearing, impose on any such person administrative measures and, or administrative penalties which may not exceed one hundred and fifty thousand euro (€150,000) for each infringement or failure to comply, as the case may be. The provisions of article 16(4) of the Act shall apply mutatis mutandis. (DIGITAL OPERATIONAL RESILIENCE ACT (DORA))

(2) Without prejudice to the generality of sub-regulation (1), the Authority shall also have the power to impose the following administrative penalties and administrative measures for any breach of any of the provisions of the DORA Regulation, the Act, these regulations and any regulations or Rules issued thereunder implementing the DORA Regulation:

(a) issue an order requiring the natural or legal person to cease the conduct in breach of the DORA Regulation, the Act, any regulations or rules issued thereunder implementing the DORA Regulation, and to desist from a repetition of such conduct;

(b) require the temporary or permanent cessation of any practice or conduct that the Authority considers to be contrary to the provisions of the DORA Regulation, the Act, any regulations or Rules issued thereunder implementing the DORA Regulation, and prevent repetition of such practice or conduct;

(c) adopt any type of measure, including of a pecuniary nature, permitted in terms of the DORA Regulation, the Act or these regulations, to ensure that financial entities in terms of the DORA Regulation continue to comply with their legal requirements;

(d) require existing data traffic records held by a telecommunication operator, where there is a reasonable suspicion of a breach of the DORA Regulation, the Act, these regulations and any regulations or rules issued thereunder implementing the DORA Regulation, and where such records may be relevant to an investigation into such breaches; and

(e) issue public notices, including public statements, which indicate the identity of the natural or legal person and the nature of the breach:

Provided that where administrative penalties and administrative measures are taken in terms of this sub-regulation with respect to a legal person, the Authority shall have the power to apply such penalties and measures, subject to any conditions that may be provided for in any other law, to members of the management body, and to other individuals who under national law are responsible for the breach.

(3) Administrative penalties and other administrative measures imposed by the Authority shall be effective, proportionate and dissuasive.

(4) When determining the type and level of an administrative penalty or other administrative measures to be imposed under these regulations, the Authority shall take into account the extent to which the breach is intentional or results from negligence, and all the relevant circumstances including, where appropriate:

(a) the materiality, gravity and the duration of the breach;

(b) the degree of responsibility of the natural or legal person responsible for the breach;

(c) the financial strength of the natural or legal person responsible for the breach;

(d) the importance of profits gained or losses avoided by the natural or legal person responsible for the breach, insofar as they can be determined;

(e) the losses for third parties caused by the breach, insofar as they can be determined;

(f) the level of cooperation with the competent authority of the natural or legal person responsible for the breach, without prejudice to the need to ensure disgorgement of profits gained or losses avoided by such person; and

(g) previous breaches by the natural or legal person responsible for the breach.

(5) The imposition by the Authority of an administrative penalty or administrative measure in terms of these regulations shall be without prejudice to any other consequence of the act or omission of the offender under civil or criminal law:

Provided that in all cases where the Authority imposes an administrative penalty or administrative measure in respect of anything done or omitted to be done by any person and such act or omission also constitutes a criminal offence, no proceedings may be taken or continued against the said person in respect of such criminal offence.