NIS 2 Directive Article 34 – General Conditions for Imposing Administrative Fines on Essential and Important Entities

The NIS 2 Directive plays a crucial role in safeguarding essential and important entities from cyber threats. Article 34 of the NIS 2 Directive focuses on the imposition of administrative fines on entities that infringe upon the provisions outlined in the directive. Let's delve deeper into the key aspects of Article 34 and understand its implications for essential and important entities.

• The Importance of Effective, Proportionate, and Dissuasive Fines

• Member States are tasked with ensuring that administrative fines imposed on essential and important entities are not just punitive but also serve as a deterrent to future violations. These fines should be effective, proportionate to the severity of the infringement, and dissuasive enough to prevent recurrent breaches of the directive.

• Additional Measures Alongside Fines

• Fines are not the only punitive measure at the authorities' disposal. Article 34 stipulates that fines can be imposed in conjunction with other measures outlined in Articles 32(4), (5), and Article 33(4) of the NIS 2 Directive. This multi-faceted approach aims to address security breaches comprehensively and ensure compliance with the directive.

• Consideration of Case-Specific Circumstances

• When determining the appropriate fines, authorities must take into account the specific circumstances of each case. Article 32(7) outlines the elements that need to be considered, such as the nature, gravity, and duration of the infringement, as well as any mitigating factors or previous breaches by the entity.

• Fines for Essential and Important Entities

• Essential entities that breach Articles 21 or 23 of the NIS 2 Directive may face fines of at least EUR 10,000,000 or 2% of their total worldwide annual turnover, whichever is higher. Important entities, on the other hand, can be fined a minimum of EUR 7,000,000 or 1.4% of their total worldwide annual turnover, whichever is higher. These substantial fines underscore the importance of compliance with the directive for entities deemed essential or important.

• Periodic Penalty Payments and Rules for Public Administration Entities

• In cases where infringements persist, Member States have the option to impose periodic penalty payments to compel entities to cease their violations. Additionally, Member States can establish rules regarding fines for public administration entities, providing further clarity on the consequences of non-compliance within the public sector.

• Legal Enforcement of Fines

• In instances where a Member State's legal framework does not accommodate administrative fines, competent authorities can initiate fines, which are then imposed by national courts. This ensures that regardless of the legal system in place, fines remain effective, proportionate, and dissuasive in nature. Member States are required to notify the Commission of relevant laws regarding administrative fines by October 17, 2024, as well as any subsequent amendments to these laws.