S.L. 591.6 · Cyber Resilience Regulations (S.L. 591.6)
S.L. 591.6 Art. 11Administrative penalties.
(1) Part VIII of the Act shall apply to any breach under Regulation (EU) 2024/2847 and these regulations.
(2) Unless otherwise specified in these regulations, proceedings in relation to a breach of these regulations and of Regulation (EU) 2024/2847 shall be instituted by the Authority and any administrative penalty imposed and, or decision taken by the Authority shall be subject to an appeal in accordance with Part IX of the Act.
(3) When deciding on the amount of the administrative penalty in each individual case, all relevant circumstances of the specific situation shall be taken into account and due regard shall be given to the following:
(a) the nature, gravity and duration of the infringement and of its consequences;
(b) whether administrative penalties have been
*Not yet in force. Vide regulation 1(3). †Not yet in force. Vide regulation 1(3). ‡Not yet in force. regulation 1(3). Vide already applied by the same or other market surveillance authorities to the same economic operator for a similar breach;
(c) the size, in particular with regard to microenterprises and small and medium sized-enterprises, including start-ups, and the market share of the economic operator committing the breach.
(4) At any stage of the proceedings in relation to a breach of these regulations and of Regulation (EU) 2024/2847, the Authority may require any person or public authority who has violated any provision of these regulations or of Regulation (EU) 2024/2847 to undertake in writing to refrain from such conduct and to take any remedial or other action as the Authority may specify.
(5) Without prejudice to sub-regulation (1), the Authority may at any stage of the proceedings in respect of any breach of these regulations or of Regulation (EU) 2024/2847, issue reprimands, warnings, or take any other similar non-monetary disciplinary measures or any other measures it may deem appropriate or necessary.
(6) The Authority may establish and publish policies and guidelines from time to time regarding the measures referred to in sub-regulation (5).
(7) The initiation of proceedings by the Authority under these regulations shall be prescribed by the lapse of two (2) years from the date on which the breach is alleged to have been committed.
*