S.L. 330.20 Art. 9Publication of administrative penalties and other administrative measures.

(1) The Authority shall publish any decision imposing an administrative penalty or other administrative measures which it shall take under these regulations on its official website, without undue delay, after the person on whom the penalty was imposed has been notified of such decision. The publication shall include information on the type and nature of the breach, the identity of the persons responsible and the administrative penalty or other administrative measures imposed:

Provided that where the Authority publishes a decision imposing an administrative penalty or other administrative measures (DIGITAL OPERATIONAL RESILIENCE ACT (DORA))

against which there is an appeal before the Financial Services Tribunal or the relevant judicial authorities, the Authority shall immediately add on its official website that information and, at later stages, any subsequent related information on the outcome of such appeal:

Provided further that any decision of the Financial Services Tribunal or other judicial decision annulling a decision of the Authority imposing an administrative penalty or other administrative measures shall also be published.

(2) Where the Authority, following a case-by-case assessment, considers that the publication of the identity of legal persons or of the identity and personal data of natural persons, as the case may be, would:

(a) be disproportionate, including risks in relation to the protection of personal data;

(b) jeopardise the stability of financial markets;

(c) jeopardise the pursuit of an ongoing criminal investigation; or

(d) cause, insofar as these can be determined, disproportionate damages to the person involved;

the Authority shall adopt one of the following solutions in respect of the decision imposing an administrative penalty or other administrative measures:

(i) defer the publication of the decision until all the reasons for non-publication cease to exist;

(ii) publish the decision on an anonymous basis; or

(iii) refrain from publishing the decision, where the options referred to in paragraphs (i) and (ii):

(a) are considered to be insufficient to guarantee a lack of any danger for the stability of financial markets; or

(b) where such publication would be disproportionate to the leniency of the imposed administrative penalty or other administrative measures.

(3) In the case of a decision to publish an administrative penalty or other administrative measures on an anonymous basis in terms of paragraph (ii) of sub-regulation (2), the publication of the relevant data may be postponed.

(4) The Authority shall ensure that any publication in accordance with this regulation shall remain on its official website only for the period which is necessary to bring forth this regulation:

Provided that this period shall not exceed five (5) years after its publication.