S.L. 586.14 Art. 13Administrative penalties. 9 10 [S.L.

(1) The Commissioner, as the designated market surveillance authority pursuant to these regulations, may institute enforcement action applicable to infringements of the Regulation (EU) 2024/1689 and these regulations committed by operators. This may include the imposition of administrative penalties, warnings and non-monetary measures:

Provided that article 20 of the Act shall mutatis mutandis apply to any decision issued by the Commissioner in the enforcement of the provisions of Regulation (EU) 2024/1689 and these regulations. An appeal shall lie to the Information and Data Protection Appeals Tribunal from any decision taken by the Commissioner and Part VI of the Act shall apply mutatis mutandis.

(2) When deciding whether to impose an administrative penalty and in determining the amount of the administrative penalty in each individual case, all relevant circumstances of the specific situation shall be taken into account and, as appropriate, regard shall be given to the following: COMMISSIONER FOR THE PURPOSES OF REGULATION

(EU) 2024/1689)

(a) the nature, gravity and duration of the infringement and of its consequences, taking into account the purpose of the AI system, as well as, where appropriate, the number of affected persons and the level of damage suffered by them;

(b) whether administrative penalties have already been applied by other market surveillance authorities to the same operator for the same infringement;

(c) whether administrative penalties have already been applied by other authorities to the same operator for infringements of other Union or national law, when such infringements result from the same activity or omission constituting a relevant infringement of these regulations and of Regulation (EU) 2024/1689;

(d) the size, the annual turnover and market share of the operator committing the infringement;

(e) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement;

(f) the degree of cooperation with the Commissioner, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

(g) the degree of responsibility of the operator taking into account the technical and organisational measures implemented by him;

(h) the manner in which the infringement became known to the Commissioner, in particular whether, and in that case to what extent, the operator notified the infringement;

(i) the intentional or negligent character of the infringement;

(j) any action taken by the operator to mitigate the harm suffered by the affected persons.

(3) The Commissioner, as the case may be, after giving due regard to the circumstances of the case shall impose an administrative penalty on a public authority or body:

Provided that such an administrative penalty shall not exceed fifty thousand euro (€50,000) for each infringement and INFORMATION AND DATA PROTECTION COMMISSIONER FOR THE PURPOSES OF REGULATION 586.14 (EU) 2024/1689)

additionally, the Commissioner, as the case may be, may impose a daily penalty of fifty euro (€50) for each day during which such infringement persists.

(4) At any stage of the proceedings in relation to an infringement of these regulations and of Regulation (EU) 2024/1689, the Commissioner may require any person, or public authority or body, which has infringed any provision of these regulations or of Regulation (EU) 2024/1689 to undertake in writing to refrain from such conduct and to take any remedial or other action as the Commissioner, may specify.

(5) The initiation of proceedings by the Commissioner shall be prescribed by the lapse of two (2) years from the date on which the infringement is alleged to have been committed.