Changes from report parliamentary committee draft to plenary report

Added1. Without prejudice to Article 20, Member States may lay down rules enabling their competent authorities to close an investigation or formal sanctioning proceeding concerning an alleged breach of this Regulation, following a settlement agreement in order to put an end to the alleged breach and its consequences before formal sanctioning proceedings are started or to close formal sanctioning proceedings by way of settlement.

Added2. Member States may lay down rules enabling their competent authorities to close an investigation concerning an established breach through an expedited enforcement procedure in order to achieve a swift adoption of a decision aiming at imposing an administrative sanction or administrative measure.

AddedThe empowerment of competent authorities to settle or open expedite enforcement procedures does not affect the obligations upon Member States under Article 20.

Added3. Where Member States lay down the rules referred to in paragraph 1, they shall notify the Commission of the relevant laws, regulations and administrative provisions regulating the exercise of powers referred to in that paragraph and shall notify it of any subsequent amendments affecting those rules.

Added1. Without prejudice to the supervisory and investigative powers of competent authorities listed in Article 18, Member States shall, in accordance with national law, provide for competent authorities to have the power to take appropriate administrative penalties and to take other administrative measures in relation to the following infringements:

Added(a) infringements of Articles 4, 5 and 6;

Added(b) infringements of Articles 7 and 8;

Added(c) infringements of Article 9 and 10;

Added(d) infringements of Articles 12, 13 and 16;

Added(e) infringements of Article 28.

Added2. Member States may decide not to lay down rules on administrative sanctions and administrative measures applicable to breaches of this Regulation which are subject to sanctions under national criminal law. In such a case, Member States shall notify the Commission of the relevant criminal law provisions and any subsequent amendments thereto.

Added3. Member States shall, in accordance with national law, ensure that competent authorities have the power to impose the following administrative penalties and other administrative measures in relation to the infringements referred to in paragraph 1:

Added(a) a public statement indicating the natural or legal person responsible and the nature of the infringement;

Added(b) an order requiring the natural or legal person responsible to cease the conduct constituting the infringement and to desist from a repetition of that conduct;

Added(c) the disgorgement of the profits gained or losses avoided due to the infringement insofar as they can be determined;

Added(d) a temporary suspension of the authorisation of a financial information service provider;

Added(e) a maximum administrative fine of at least twice the amount of the profits gained or losses avoided because of the infringement where those can be determined, even if such fine exceeds the maximum amounts set out in this paragraph, point (f), as regards natural persons, or in paragraph 4 as regards legal persons;

Added(f) in the case of a natural person, maximum administrative fines of up to EUR 35 000 per infringement and up to a total of EUR 350 000 per year, or, in the Member States whose official currency is not the euro, the corresponding value in the official currency of that Member State on ... [OP please insert the date of entry into force of this Regulation].

Added(g) a temporary ban of any member of the management body of the financial information service provider, or any other natural person who is held responsible for the infringement, from exercising management functions in financial information service providers;

Added(h) in the event of a repeated infringement of the articles referred to in paragraph 1, a ban of at least 10 years for any member of the management body of a financial information service provider, or any other natural person who is held responsible for the infringement, from exercising management functions in a financial information service provider.

Added4. Member States shall, in accordance with national law, ensure that competent authorities have the power to impose, in relation to the infringements referred to in paragraph 1 committed by legal persons, maximum administrative fines of:

Added(a) up to EUR 160 000 per infringement and up to a total of EUR 1600 000 per year, or, in the Member States whose official currency is not the euro, the corresponding value in the official currency of that Member State on ... [OP please insert the date of entry into force of this Regulation];

Added(b) 4,5% of the total annual turnover of the legal person of the preceding financial year, according to the last available financial statements approved by the management body;

AddedWhere the legal person referred to in the first subparagraph is a parent undertaking or a subsidiary of a parent undertaking which is required to prepare consolidated financial statements in accordance with Article 22 of Directive 2013/34/EU of the European Parliament and of the Council, the relevant total annual turnover shall be the net turnover or the revenue to be determined in accordance with the relevant accounting standards, according to the consolidated financial statements of the ultimate parent undertaking available for the latest balance sheet date, for which the members of the administrative, management and supervisory body of the ultimate undertaking have responsibility.

Added5. Member States may empower competent authorities to impose other types of administrative penalties and other administrative measures in addition to those referred to in paragraphs 3 and 4 and may provide for higher amounts of administrative pecuniary fines than those laid down in those paragraphs.

AddedMember States shall notify to the Commission the level of such higher penalties, and any subsequent amendments thereto.

Added1. Competent authorities shall be entitled to impose periodic penalty payments on legal or natural persons for an ongoing failure to comply with any decision, order, interim measure, request, obligation or other administrative measure adopted in accordance with this Regulation.

AddedA periodic penalty payment referred to in the first subparagraph shall be effective and proportionate and shall consist of a daily amount to be paid until compliance is restored. They shall be imposed for a period not exceeding 6 months from the date indicated in the decision imposing the periodic penalty payments.

AddedCompetent authorities shall be entitled to impose the following periodic penalty payments which may be adjusted depending on the seriousness of the breach and the needs of the sector:

Added(a) 3% of the average daily turnover in the case of a legal person;

Added(b) EUR 30 000 in the case of a natural person.

Added2. The average daily turnover referred to in paragraph 1, third subparagraph, point (a), shall be the total annual turnover, divided by 365.

Added3. Member States may provide for higher amounts of periodic penalty payments than those laid down in paragraph 1, third subparagraph.

AddedArticle 22 Circumstances to be considered when determining administrative penalties and other administrative measures

Added1. Competent authorities, when determining the type and level of administrative penalties or other administrative measure, shall take into account all relevant circumstances in order to ensure that such sanctions or measures are effective and proportionate. Those circumstances shall include, where appropriate:

Added(a) the nature, gravity and the duration of the breach taking into account the nature, scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;

Added(b) the degree of responsibility of the legal or natural person responsible for the breach;

Added(c) the financial strength of the legal or natural person responsible for the breach, as indicated, among other things, by the total annual turnover of the legal person, or the annual income of the natural person responsible for the breach;

Added(d) the level of profits gained or losses avoided by the legal or natural person responsible for the breach, if such profits or losses can be determined;

Added(e) the losses for third parties caused by the breach, if such losses can be determined;

Added(f) the disadvantage resulting to the legal or natural person responsible for the breach from the duplication of criminal and administrative proceedings and penalties for the same conduct;

Added(fa) the categories of personal data affected by the infringement;

Added(g) the impact of the breach on the interests of customers;.

Added(h) any actual or potential systemic negative consequences of the breach;

Added(i) the complicity or organised participation of more than one legal or natural person in the breach;

Added(j) previous breaches committed by the legal or natural person responsible for the breach;

Added(k) the level of cooperation of the legal or natural person, responsible for the breach, with the competent authority;

Added(ka) the manner in which the infringement became known to the competent authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;

Added(l) any remedial action or measure undertaken by the legal or natural person responsible for the breach to prevent its repetition.

Added2. Competent authorities that use settlement agreements or expedited enforcement procedures pursuant to Article 19 shall adapt the relevant administrative penalties and other administrative measures provided for in Article 20 to the case concerned to ensure the proportionality thereof, in particular by considering the circumstances listed in paragraph 1.

Added1. All persons who work or who have worked for the competent authorities, as well as experts acting on behalf of the competent authorities, are bound by the obligation of professional secrecy.

Added2. The information exchanged in accordance with Article 26 shall be subject to the obligation of professional secrecy by both the sharing and recipient authority to ensure the protection of individual and business rights.

Added1. Decisions taken by the competent authorities pursuant to this Regulation, may be contested before the courts.

Added2. Paragraph 1 shall apply also in respect of a failure to act.

Added1. Competent authorities shall publish on their website all decisions imposing an administrative penalty or administrative measure on legal and natural persons, for breaches of this Regulation, and where applicable, all settlement agreements. The publication shall include, a short description of the breach, the administrative penalty or other administrative measure imposed, or, where applicable, a statement about the settlement agreement. The identity of the natural person subject to the decision imposing an administrative penalty or administrative measure shall not be published.

AddedCompetent authorities shall publish the decision and the statement referred to in paragraph 1 immediately after the legal or natural person subject to the decision has been notified of that decision or the settlement agreement has been signed.

Added2. By derogation from paragraph 1, where the publication of the identity or other personal data of the natural person is deemed necessary by the national competent authority to protect the stability of the financial markets or, to ensure the effective enforcement of this Regulation, including in the case of public statements referred to in Article 20(3) point (a), or temporary bans referred to in Article 20(3) point (g), the national competent authority may publish also the identity of the persons or personal data, provided that it justifies such a decision and that the publication is limited to the personal data that is strictly necessary to protect the stability of the financial markets or to ensure the effective enforcement of this Regulation.

Added3. Where the decision imposing an administrative penalty or other administrative measure is subject to appeal before the relevant judicial or other authority, competent authorities shall also publish on their official website, without delay, information on the appeal and any subsequent information on the outcome of such an appeal insofar as it concerns legal persons. Where the appealed decision concerns natural persons and the derogation under paragraph 2 is not applied, competent authorities shall publish information on the appeal only in an anonymised version.

Added4. Competent authorities shall ensure that any publication made in accordance with this Article remains on their official website for a period of at least 5 years. Personal data contained in the publication shall be kept on the official website of the competent authority only if an annual review shows the continued need to publish that data to protect the stability of the financial markets or to ensure the effective enforcement of this Regulation, and in any event for no longer than 5 years.

Added1. Competent authorities shall cooperate with each other and with other relevant competent authorities designated under Union or national law applicable to financial institutions for the purposes of this Regulation carrying out the duties of the competent authorities.