The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020

Amendments to regulation 18 (penalties)

14.  In regulation 18—

(a) for paragraphs (1) and (2) substitute—

“(1) The designated competent authority for an OES may serve a notice of intention to impose a penalty on the OES if it has reasonable grounds to believe that the OES has failed to comply with a duty referred to in regulation 17(1) or the duty set out in regulation 17(3A) and considers that a penalty is warranted having regard to the facts and circumstances of the case.

(2) The Information Commissioner may serve a notice of intention to impose a penalty on a RDSP if it has reasonable grounds to believe that the RDSP has failed to comply with a duty referred to in regulation 17(2) or the duty set out in regulation (3A) and considers that a penalty is warranted having regard to the facts and circumstances of the case.”;

(b) in paragraph (3)—

(i) in the opening text, for “penalty notice” substitute “notice of intention to impose a penalty”;

(ii) in sub-paragraph (b), after “that is” insert “intended”;

(iii) in sub-paragraph (c), after “notice”, insert “of intention to impose a penalty”;

(iv) for sub-paragraphs (d) to (f) substitute—

“(d) the period within which a penalty will be required to be paid if a penalty notice is served;

(e) that the payment of a penalty under a penalty notice (if any) is without prejudice to the requirements of any enforcement notice (if any); and

(f) how and when representations may be made about the content of the notice of intention to impose a penalty and any related matters.”;

(c) after paragraph (3), insert—

“(3A) The relevant competent authority may, after considering any representations submitted in accordance with paragraph (3)(f), serve a penalty notice on the OES with a final penalty decision if the authority is satisfied that a penalty is warranted having regard to the facts and circumstances of the case.

(3B) The Information Commissioner may, after considering any representations submitted in accordance with paragraph (3)(f), serve a penalty notice on the RDSP with a final penalty decision if the Commissioner is satisfied that a penalty is warranted having regard to the facts and circumstances of the case.

(3C) The relevant competent authority or the Information Commissioner may serve a notice of intention to impose a penalty or a penalty notice irrespective of whether it has served or is contemporaneously serving an enforcement notice on the OES or RDSP under regulation 17(1) or (2).

(3D) A penalty notice must—

(a) be given in writing to the OES or RDSP;

(b) include reasons for the final penalty decision;

(c) require the OES or RDSP to pay—

(i) the penalty specified in the notice of intention to impose a penalty; or

(ii) such penalty as the relevant competent authority or the Information Commissioner considers appropriate in the light of any representations made by the OES or RDSP and any steps taken by the OES or RDSP to rectify the failure or to do one or more of the things required by an enforcement notice under regulation 17(3);

(d) specify the period within which the penalty must be paid (“the payment period”) and the date on which the payment period is to commence;

(e) provide details of the appeal process under regulation 19A; and

(f) specify the consequences of failing to make payment within the payment period.

(3E) It is the duty of the OES or RDSP to comply with any requirement imposed by a penalty notice.”;

(d) in paragraph (5), in the opening text, for the words from “that is” to “served” substitute “of any penalty imposed”;

(e) in paragraph (6)—

(i) in the opening text, omit “that is to be imposed under a penalty notice”;

(ii) in sub-paragraph (a)—

(aa) after “which the” insert “NIS”;

(bb) for “could not cause a NIS incident” substitute “was not a material contravention”;

(iii) omit sub-paragraph (b);

(iv) in sub-paragraph (c)—

(aa) after “which the” insert “NIS”;

(bb) for the words from “has caused” to the end substitute “does not meet the criteria set out in sub-paragraph (d)”;

(v) in sub-paragraph (d)—

(aa) after “which the” insert “NIS”;

(bb) for the words from “has caused” to the end substitute “has or could have created a significant risk to, or significant impact on, or in relation to, the service provision by the OES or RDSP.”;

(f) in paragraph (7)—

(i) in sub-paragraph (a), for paragraphs (i) and (ii) substitute—

“(i) a failure to take, or adequately take, one or more of the steps required under an enforcement notice within the period specified in that notice to rectify a failure described in one or more of—

(aa) sub-paragraphs (a) to (d) of regulation 17(1); or

(bb) sub- paragraphs (a) to (d) of regulation 17(2); or

(ii) where an enforcement notice was not served or where no steps were required to be taken under an enforcement notice, a failure described in one or more of—

(aa) sub-paragraphs (a) to (d) of regulation 17(1); or

(bb) sub-paragraphs (a) to (d) of regulation 17(2).”;

(ii) omit sub-paragraph (b).