S.L. 591.5 Art. 11Administrative penalties.

(1) Without prejudice to the specific provisions on penalties established under Chapter XII of Regulation (EU) 2024/ 1689, any operator who commits an infringement of these regulations or of Regulation (EU) 2024/1689 shall be liable to an administrative penalty of up to three hundred and fifty thousand euro (€350,000) for each infringement or, in the case where the offender is an undertaking, up to one per cent (1%) of its total worldwide annual turnover for the preceding financial year, whichever is higher.

(2) Without prejudice to the specific provisions on penalties established under Chapter XII of Regulation (EU) 2024/1689, the Malta Digital Innovation Authority may, instead of, or in addition to the administrative penalty referred to in sub-regulation (1) impose on an operator who commits an infringement of these regulations or of Regulation (EU) 2024/1689 a daily penalty of twelve thousand euro (€12,000) for each day during which such infringement persists.

(3) Unless otherwise specified in these regulations, proceedings in relation to an infringement of these regulations and of Regulation (EU) 2024/1689 shall be instituted by the Malta Digital Innovation Authority and any administrative penalty imposed and, or decision taken by the Malta Digital Innovation Authority shall be subject to an appeal in accordance with Part IX of the Act.

(4) When deciding whether to impose an administrative penalty and in determining the amount of the administrative penalty in each case, all relevant circumstances of the specific situation shall be taken into account and, as appropriate, regard shall be given to the following:

(a) the nature, gravity and duration of the infringement and of its consequences, taking into account the purpose of the AI system, as well as, where appropriate, the number of affected persons and the level of damage suffered by them;

(b) whether administrative penalties have already been applied by other market surveillance authorities to the same operator for the same infringement;

(c) whether administrative penalties have already been applied by other authorities to the same operator for infringements of other Union or national law, when such infringements result from the same activity or omission constituting a relevant infringement of these regulations and of Regulation (EU) 2024/1689;

(d) the size, the annual turnover and market share of the operator committing the infringement;

(e) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement;

(f) the degree of cooperation with the national competent authorities, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

(g) the degree of responsibility of the operator taking into account the technical and organisational measures implemented by it;

(h) the manner in which the infringement became known to the national competent authorities, in particular whether, and if so to what extent, the operator notified the infringement;

(i) the intentional or negligent character of the infringement;

(j) any action taken by the operator to mitigate the harm suffered by the affected persons.

(5) The Malta Digital Innovation Authority, as the case may be, may, after giving due regard to the circumstances of the case impose an administrative penalty on a public authority or body:

Provided that such an administrative penalty shall not exceed fifty thousand euro (€50,000) for each infringement and, additionally, the Malta Digital Innovation Authority, as the case may be, may impose a daily penalty of fifty euro (€50) for each day during which such infringement persists.

(6) At any stage of the proceedings in relation to an infringement of these regulations and of Regulation (EU) 2024/1689, the Malta Digital Innovation Authority may require any person or public authority who has violated any provision of these regulations or of Regulation (EU) 2024/1689 to undertake in writing to refrain from such conduct and to take any remedial or other action as the Malta Digital Innovation Authority may specify.

(7) Without prejudice to sub-regulations (1),(2),(5) and (6), the Malta Digital Innovation Authority may at any stage of the proceedings in respect of any infringement of these regulations or of Regulation (EU) 2024/1689, issue reprimands, warnings, or take any other similar non-monetary disciplinary measures or any other measures it may deem appropriate or necessary.

(8) The Malta Digital Innovation Authority may establish and publish policies and guidelines from time to time regarding the measures referred to in sub-regulation (7).

(9) The initiation of proceedings by the Malta Digital Innovation Authority under these regulations shall be prescribed by the lapse of two (2) years from the date on which the infringement is alleged to have been committed.