The Network and Information Systems Regulations 2018

PART 6 U.K. Miscellaneous

Fees U.K.

21.—(1) A fee is payable by an OES or a RDSP to an enforcement authority, to recover the reasonable costs incurred by, or on behalf of, that authority in carrying out a NIS function in relation to that OES or RDSP.

(2) The fee mentioned in paragraph (1) must be paid to the enforcement authority within 30 days after receipt of the invoice sent by the authority.

(3) The invoice must state the work done and the reasonable costs incurred by, or on behalf of, the enforcement authority, including the time period to which the invoice relates.

(4) An enforcement authority may determine not to charge a fee under paragraph (1) in any particular case.

(5) A fee payable under this regulation is recoverable as a civil debt.

(6) In this regulation—

(a) a “NIS function” means a function that is carried out under these Regulations except any function under regulations 17(1) to (4) and 18 to 20; and

(b) “enforcement authority” has the same meaning as in regulation 18(7)(b).

Proceeds of penalties U.K.

22.—(1) The sum that is received by a NIS enforcement authority as a result of a penalty notice served under regulation 18 must be paid into the Consolidated Fund unless paragraph (2) applies.

(2) The sum that is received as a result of a penalty notice served under regulation 18 by—

(a) the Welsh Ministers must be paid into the Welsh Consolidated Fund established under section 117 of the Government of Wales Act 2006 M1 ; and

(b) the Scottish Ministers or the Drinking Water Quality Regulator for Scotland, must be paid into the Scottish Consolidated Fund established under section 64 of the Scotland Act 1998 M2 .

Marginal Citations

M1 2006 c. 32.

M2 1998 c. 46. Sub-section 2A of section 64 was inserted by section 16(1) and (2) of the Scotland Act 2016 (c. 11).

Enforcement action – general considerations U.K.

23.—(1) Before a NIS enforcement authority takes any action under regulation [F1 17(1) or (2), 18(3A) or (3B) or A20,] the enforcement authority must consider whether it is reasonable and proportionate, on the facts and circumstances of the case, to take action in relation to the contravention.

(2) The NIS enforcement authority must, in particular, have regard to the following matters—

(a) any representations made by the OES or RDSP, as the case may be, about the contravention and the reasons for it, if any;

(b) any steps taken by the OES or RDSP to comply with the requirements set out in these Regulations;

(c) any steps taken by the OES or RDSP to rectify the contravention;

(d) whether the OES or RDSP had sufficient time to comply with the requirements set out in these Regulations; and

(e) whether the contravention is also liable to enforcement under another enactment.

Textual Amendments

F1 Words in reg. 23(1) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 18 (with reg. 21)

Service of documents U.K.

24.—(1) Any document or notice required or authorised by these Regulations to be served on a person may be served by—

(a) delivering it to that person in person;

(b) leaving it at the person's proper address; or

(c) sending it by post or electronic means to that person's proper address.

(2) In the case of a body corporate, a document may be served on a director of that body.

(3) In the case of a partnership, a document may be served on a partner or person having control or management of the partnership business.

(4) If a person has specified an address in the United Kingdom (other than that person's proper address) at which that person or someone on that person's behalf will accept service, that address must also be treated as that person's proper address.

(5) For the purposes of this regulation “proper address” means—

(a) in the case of a body corporate or its director—

(i) the registered or principal office of that body; or

(ii) the email address of the secretary or clerk of that body;

(b) in the case of a partnership, a partner or person having control or management of the partnership business—

(i) the principal office of the partnership; or

(ii) the email address of a partner or a person having that control or management;

(c) in any other case, a person's last known address, which includes an email address.

(6) In this regulation, “partnership” includes a Scottish partnership.

Review and report U.K.

25.—(1) The Secretary of State must—

(a) carry out a review of the regulatory provision contained in these Regulations [F2 and in EU Regulation 2018/151]; and

(b) publish a report setting out the conclusions of that review.

(2) The first report must be published on or before 9th May 2020 [F3 , the second report must be published on or before 9th May 2022] and subsequent reports must be published at [F4 intervals not exceeding five years].

F5 (3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

[F6 (4) Section 30(4) of [F7 the Small Business, Enterprise and Employment Act 2015] requires that reports published under this regulation must, in particular—

(a) set out the objectives intended to be achieved by the regulatory provision referred to in paragraph (1)(a);

(b) assess the extent to which those objectives are achieved;

(c) assess whether those objectives remain appropriate; and

(d) if those objectives remain appropriate, assess the extent to which they could be achieved in another way which involves less onerous regulatory provision.]

[F6 (5) In this regulation “regulatory provision” has the same meaning as in sections 28 to 32 of that Act.]

Textual Amendments

F2 Words in reg. 25(1)(a) inserted (20.1.2021) by The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 13(a); 2020 c. 1, Sch. 5 para. 1(1)

F3 Words in reg. 25(2) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 19(a)(i) (with reg. 21)

F4 Words in reg. 25(2) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 19(a)(ii) (with reg. 21)

F5 Reg. 25(3) omitted (20.1.2021) by virtue of The Network and Information Systems (Amendment etc.) (EU Exit) Regulations 2019 (S.I. 2019/653), reg. 1(2), Sch. para. 13(b); 2020 c. 1, Sch. 5 para. 1(1)

F6 Reg. 25(3)-(5) substituted (20.6.2018) by The Network and Information Systems (Amendment) Regulations 2018 (S.I. 2018/629), reg. 2(11)

F7 Words in reg. 25(4) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 19(b) (with reg. 21)