|
+Article 32 7. |
Article 32 7.When taking any of the enforcement measures referred to in paragraph 4 or 5, the competent authorities shall comply with the rights of the defence and take account of the circumstances of each individual case and, as a minimum, take due account of:
(a)
the seriousness of the infringement and the importance of the provisions breached, the following, inter alia, constituting serious infringement in any event:
(i)
repeated violations;
(ii)
a failure to notify or remedy significant incidents;
(iii)
a failure to remedy deficiencies following binding instructions from competent authorities;
(iv)
the obstruction of audits or monitoring activities ordered by the competent authority following the finding of an infringement;
(v)
providing false or grossly inaccurate information in relation to cybersecurity risk-management measures or reporting obligations laid down in Articles 21 and 23;
(b)
the duration of the infringement;
(c)
any relevant previous infringements by the entity concerned;
(d)
any material or non-material damage caused, including any financial or economic loss, effects on other services and the number of users affected;
(e)
any intent or negligence on the part of the perpetrator of the infringement;
(f)
any measures taken by the entity to prevent or mitigate the material or non-material damage;
(g)
any adherence to approved codes of conduct or approved certification mechanisms;
(h)
the level of cooperation of the natural or legal persons held responsible with the competent authorities. 1. Přehled
1.1 Odkazy1.2 Identifikované požadavky1.3 Související standardy2. Identifikované požadavky
3. Související standardy
|