Exercise of the power to impose administrative penalties and remedial measures

Article 51 governs how competent authorities exercise their power to impose administrative penalties and remedial measures under DORA. The article establishes detailed criteria for determining the appropriate type and level of penalty, ensuring consistency and proportionality in enforcement across Member States.

The criteria include the gravity and duration of the breach, the degree of responsibility of the entity, its financial strength, the amount of profits gained or losses avoided, the losses caused to third parties, the level of cooperation with the competent authority, and any previous breaches. These factors must be weighed holistically to arrive at a penalty that is effective, proportionate, and dissuasive.

Aggravating factors include systematic non-compliance, deliberate concealment of breaches, and failure to take remedial action after being notified of deficiencies. Mitigating factors include prompt self-reporting, voluntary remedial measures, and first-time offences. The balance between these factors ensures that penalties serve their purpose of achieving compliance rather than being punitive for their own sake.

Due process protections are integral — entities must be informed of the findings, given an opportunity to be heard, and have the right to appeal any penalty decision before a competent judicial authority.