The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020

Amendments to regulation 17 (enforcement for breach of duties)

13.  In regulation 17—

(a) in the heading, after “enforcement” insert “notices”;

(b) in paragraph (1)—

(i) in the opening text—

(aa) at the beginning, insert “Subject to paragraph (2A),”;

(bb) omit “competent” in the second place it occurs;

(ii) before sub-paragraph (a) insert—

“(za) notify it under regulation 8(2);

(zb) comply with the requirements stipulated in regulation 8A;”;

(c) in paragraph (2)—

(i) at the beginning insert “Subject to paragraph (2A),”;

(ii) after sub-paragraph (d) insert—

“(da) comply with the requirements stipulated in regulation 14A(1);”;

(d) after paragraph (2), insert—

“(2A) Before serving an enforcement notice under paragraph (1) or (2), the relevant competent authority or the Information Commissioner must inform the OES or RDSP, in such form and manner as it considers appropriate having regard to the facts and circumstances of the case, of—

(a) the alleged failure; and

(b) how and by when representations may be made in relation to the alleged failure and any related matters.

(2B) When the relevant competent authority or the Information Commissioner informs the OES or RDSP in accordance with paragraph (2A), it may also provide notice of its intention to serve an enforcement notice.

(2C) The relevant competent authority or the Information Commissioner may serve an enforcement notice on the OES or RDSP within a reasonable time, irrespective of whether it has provided any notice in accordance with paragraph (2B), having regard to the facts and circumstances of the case, after it has informed the OES or RDSP in accordance with paragraph (2A).

(2D) The relevant competent authority or the Information Commissioner must have regard to any representations made under paragraph (2A)(b).”;

(e) in paragraph (3)—

(i) after sub-paragraph (b), insert “and”;

(ii) omit sub-paragraph (d) and “and” before it;

(f) after paragraph (3) insert—

“(3A) An OES or RDSP upon whom an enforcement notice has been served under paragraph (1) or (2) must comply with the requirements, if any, of the notice regardless of whether the OES or RDSP has paid any penalty imposed on it under regulation 18.”;

(g) in paragraph (4)(a)—

(i) for “the” substitute “any,”;

(ii) for “(3)(d)” substitute “(2A)”.

(1)

Regulation 14A and the related definition of “representative” are inserted into the 2018 Regulations by regulation 2 of S.I. 2019/1444 which comes into force on 20th January 2021.