S.L. 591.3 Art. 9Infringements.

(1) Articles 42, 43, 44 and Part IX of the Act shall apply to infringements of the obligations regarding transfers of non-personal data to third countries pursuant to Article 5(14) and Article 31 of Regulation (EU) 2022/868, the notification obligation of data intermediation services providers pursuant to Article 11 of Regulation

(EU) 2022/868, the conditions for providing data intermediation services pursuant to Article 12 of Regulation (EU) 2022/868 and the conditions for the registration as a recognised data altruism organisation pursuant to Articles 18, 20, 21 and 22 of Regulation (EU) 2022/868:

(2) Without prejudice to the provisions of the Act, due regard shall be made to the following non-exhaustive and indicative criteria for the imposition of administrative penalties on data intermediation services providers and recognised data altruism organisations for infringements of the obligations referred to in this regulation, where appropriate:

(a) the nature, gravity, scale and duration of the infringement;

(b) any action taken by the data intermediation services provider or recognised data altruism organisation to mitigate or remedy the damage caused by the infringement;

(c) any previous infringements by the data intermediation services provider or recognised data altruism organisation;

(d) the financial benefits gained or losses avoided by the data intermediation services provider or recognised data altruism organisation due to the infringement, insofar as such benefits or losses can be reliably established;

(e) any other aggravating or mitigating factors applicable to the circumstances of the case.

(3) The Malta Digital Innovation Authority may, at its discretion, prior to initiating any proceedings in relation to an infringement of the obligations regarding transfers of non-personal data to third countries pursuant to Article 5(14) of Regulation (EU) 2022/868 consult with the Data Governance Council and, or any other relevant person.