Regulation (EU) 2023/2854 — Article 40

Article total: 2 parts · 3 Council drafts · 9 Parliament amendments

Tracked part

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to Data Act

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 13 December 2023, with the Commission proposal change affecting this article applied.

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

This Article shall not apply to Chapter VIIc.

Commission source wording and instructions

Article 40(6)

Commission proposal

6. This Article shall not apply to Chapter VIIc.

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Council document

View full Council comparison →

Article in June Presidency compromise · 10 June Council text

Comparison basis: Existing law (13 December 2023) compared with June Presidency compromise · 10 June (10 June 2026)

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

~~For~~This ~~infringements~~Article ofshall ~~the~~not ~~obligations~~apply ~~laid down in~~to Chapter IIVIIa, ~~III~~VIIb and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that RegulationVIIc.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.

Article 40(4)

June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

(4) This Article shall not apply to Chapter VIIa, VIIb and VIIc.

Article 40(6) 3 Council drafts

Article 40(4)

10 June 2026 · June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

(4) This Article shall not apply to Chapter VIIa, VIIb and VIIc.

Article 40(4)

18 June 2026 · June Presidency compromise · 18 June

Council wording reconstructed for this provision from the official operation

(4) This Article shall not apply to Chapter VIIb and VIIc.

Article 40(6)

3 September 2026 · September Presidency compromise

Council wording reconstructed for this provision from the official operation

6. This Article shall not apply to Chapter VIIb and VIIc.

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

Search amendments

Political group at the amendment date where available; otherwise the current Parliament affiliation.

Remove proposed wording Amendment 86 IMCO draft opinion · Alex Agius Saliba (rapporteur)

~~20. in Article 40, paragraph (6) is inserted: 6. This Article shall not apply to Chapter VIIc.’~~

Justification

This is a issue of enforceability, if Chapter VIIc contains safeguards but is carved out from sanctions, the safeguards become weaker in practice. The merger of different legal acts in the Data Act must not weaken enforceability or lead to weaker rights and obligations.

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

~~This Article shall not apply to Chapter VIIc.~~

Remove proposed wording Amendment 229 JURI

~~6. This Article shall not apply to Chapter VIIc.~~

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

~~This Article shall not apply to Chapter VIIc.~~

Remove proposed wording Amendment 328 IMCO

~~20. in Article 40, paragraph (6) is inserted: 6. This Article shall not apply to Chapter VIIc.’~~

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

~~This Article shall not apply to Chapter VIIc.~~

Remove proposed wording Amendment 329 IMCO

~~20. in Article 40, paragraph (6) is inserted: 6. This Article shall not apply to Chapter VIIc.’~~

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

~~This Article shall not apply to Chapter VIIc.~~

Alternative wording Amendment 330 IMCO

20. In Article 40, paragraph (6) is inserted:

Infringements of the obligations laid down in Chapter VIIc shall result in effective, proportionate and dissuasive administrative sanctions. Member States shall appoint competent authorities to impose such sanctions and, in particular, ensure that these authorities can impose sanctions in connection with unlawful transfers of data to third countries, the reidentification of pseudonymised or anonymised data, and any improper use of data re-used under this Chapter. The criteria laid down in paragraph 3 shall apply.

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

~~This~~Infringements ~~Article~~of ~~shall~~the ~~not~~obligations ~~apply~~laid todown in Chapter VIIc shall result in effective, proportionate and dissuasive administrative sanctions. Member States shall appoint competent authorities to impose such sanctions and, in particular, ensure that these authorities can impose sanctions in connection with unlawful transfers of data to third countries, the reidentification of pseudonymised or anonymised data, and any improper use of data re-used under this Chapter. The criteria laid down in paragraph 3 shall apply.

Remove proposed wording Amendment 875 ITRE · LIBE

~~20. in Article 40, paragraph (6) is inserted: 6. This Article shall not apply to Chapter VIIc.’~~

Justification

This is a direct enforceability point. If Chapter VIIc contains safeguards but is carved out from sanctions, the safeguards become weaker in practice. We stressed that the merger must not weaken enforceability or create fragile rights and obligations.

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

~~This Article shall not apply to Chapter VIIc.~~

Remove proposed wording Amendment 876 ITRE · LIBE

~~6. This Article shall not apply to Chapter VIIc.~~

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

~~This Article shall not apply to Chapter VIIc.~~

Additional proposed wording Amendment 877 ITRE · LIBE

6a.

The infringements of the obligations laid down in Chapter VIIc shall be subject to effective, proportionate and dissuasive administrative penalties. Member States shall designate the authorities competent to impose such penalties and shall ensure that they may, in particular, sanction the unlawful transfer of data to third countries, the re-identification of pseudonymised or anonymised data, and any misuse of data re-used under that Chapter. The criteria set out in paragraph 3 shall apply.

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

This Article shall not apply to Chapter VIIc.
6a.

The infringements of the obligations laid down in Chapter VIIc shall be subject to effective, proportionate and dissuasive administrative penalties. Member States shall designate the authorities competent to impose such penalties and shall ensure that they may, in particular, sanction the unlawful transfer of data to third countries, the re-identification of pseudonymised or anonymised data, and any misuse of data re-used under that Chapter. The criteria set out in paragraph 3 shall apply.

Additional proposed wording Amendment 878 ITRE · LIBE

6b. In Article 40, the following paragraph 6a is inserted:

For infringements of the obligations laid down in Chapter VIIc, the competent authorities responsible for monitoring the application of that Chapter may, within their scope of competence, impose administrative fines in accordance with national law. The rules on penalties referred to in paragraph 1 shall apply, in particular, to:

(a)

the re-use of data or documents in breach of lawfully imposed conditions or for purposes other than those authorised;

(b)

the unlawful transfer or onward transfer of data or documents to a third country, or failure to comply with the related information, notification, transparency or safeguard requirements;

(c)

failure to comply with obligations protecting intellectual property rights, trade secrets, statistical or commercial confidentiality or other protected data;

(d)

the conclusion, maintenance or performance of an exclusivity arrangement prohibited by, or incompatible with, Chapter VIIc;

(e)

the intentional or negligent provision of materially inaccurate, incomplete or misleading information in order to obtain a right of re-use;

(f)

failure to delete or return data or documents, or to cease their use or re-use, where the applicable conditions are no longer met.

In addition to administrative fines, the competent authorities may, in accordance with national law and where necessary and proportionate, suspend or withdraw the right of re-use, temporarily prohibit new requests for re-use, or order the cessation, deletion or return of the data or documents concerned. When determining the type and level of penalties or other measures, the competent authorities shall take into account the criteria set out in paragraph 3 and, where relevant, the intentional or negligent character of the infringement, any transfer to a third country, the sensitive or strategic nature of the data or documents concerned, and any adverse impact on public or economic security, critical infrastructure, essential services or the essential interests of a Member State.

When applying paragraph 6 to microenterprises and small and medium-sized enterprises, the competent authorities shall take into account their size, economic capacity and any corrective measures taken without undue delay. This shall not preclude effective, proportionate and dissuasive penalties for intentional, repeated or serious infringements.'

Preview
against:

Article 40

Penalties

1.

Member States shall lay down the rules on penalties applicable to infringements of this Regulation and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
2.

Member States shall by 12 September 2025 notify the Commission of those rules and measures and shall notify it without delay of any subsequent amendment affecting them. The Commission shall regularly update and maintain an easily accessible public register of those measures.
3.
Member States shall take into account the recommendations of the EDIB and the following non-exhaustive criteria for the imposition of penalties for infringements of this Regulation:
1. (a)
  
  the nature, gravity, scale and duration of the infringement;
2. (b)
  
  any action taken by the infringing party to mitigate or remedy the damage caused by the infringement;
3. (c)
  
  any previous infringements by the infringing party;
4. (d)
  
  the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established;
5. (e)
  
  any other aggravating or mitigating factor applicable to the circumstances of the case;
6. (f)
  
  infringing party’s annual turnover in the preceding financial year in the Union.
4.

For infringements of the obligations laid down in Chapter II, III and V of this Regulation, the supervisory authorities responsible for monitoring the application of Regulation (EU) 2016/679 may within their scope of competence impose administrative fines in accordance with Article 83 of Regulation (EU) 2016/679 and up to the amount referred to in Article 83(5) of that Regulation.
5.

For infringements of the obligations laid down in Chapter V of this Regulation, the European Data Protection Supervisor may impose within its scope of competence administrative fines in accordance with Article 66 of Regulation (EU) 2018/1725 up to the amount referred to in Article 66(3) of that Regulation.
6.

This Article shall not apply to Chapter VIIc.
6a.
For infringements of the obligations laid down in Chapter VIIc, the competent authorities responsible for monitoring the application of that Chapter may, within their scope of competence, impose administrative fines in accordance with national law. The rules on penalties referred to in paragraph 1 shall apply, in particular, to:
1. (a)
  
  the re-use of data or documents in breach of lawfully imposed conditions or for purposes other than those authorised;
2. (b)
  
  the unlawful transfer or onward transfer of data or documents to a third country, or failure to comply with the related information, notification, transparency or safeguard requirements;
3. (c)
  
  failure to comply with obligations protecting intellectual property rights, trade secrets, statistical or commercial confidentiality or other protected data;
4. (d)
  
  the conclusion, maintenance or performance of an exclusivity arrangement prohibited by, or incompatible with, Chapter VIIc;
5. (e)
  
  the intentional or negligent provision of materially inaccurate, incomplete or misleading information in order to obtain a right of re-use;
6. (f)
  
  failure to delete or return data or documents, or to cease their use or re-use, where the applicable conditions are no longer met.
7. In addition to administrative fines, the competent authorities may, in accordance with national law and where necessary and proportionate, suspend or withdraw the right of re-use, temporarily prohibit new requests for re-use, or order the cessation, deletion or return of the data or documents concerned. When determining the type and level of penalties or other measures, the competent authorities shall take into account the criteria set out in paragraph 3 and, where relevant, the intentional or negligent character of the infringement, any transfer to a third country, the sensitive or strategic nature of the data or documents concerned, and any adverse impact on public or economic security, critical infrastructure, essential services or the essential interests of a Member State.
8. 7.
  
  When applying paragraph 6 to microenterprises and small and medium-sized enterprises, the competent authorities shall take into account their size, economic capacity and any corrective measures taken without undue delay. This shall not preclude effective, proportionate and dissuasive penalties for intentional, repeated or serious infringements.'

Article in June Presidency compromise · 10 June Council text

Article in June Presidency compromise · 18 June Council text

Article in September Presidency compromise Council text

Changes in context

European Commission proposal

Council Presidency text · ST 10426/26

Changes in context

Council Presidency text · ST 10426/26

Council Presidency text · ST 10677/26

Changes in context

Council Presidency text · ST 10677/26

Council Presidency text · ST 12535/26

Changes in context

Wording reproduced in the amendment

Amendment 875 · ITRE–LIBE amendments 777–1052 to the draft report: removal

Changes in context

Wording reproduced in the amendment

Amendment 876 · ITRE–LIBE amendments 777–1052 to the draft report: removal

Changes in context

Wording reproduced in the amendment

Amendment 328 · IMCO amendments 125–328 to the draft opinion: removal

Changes in context

Wording reproduced in the amendment

Amendment 329 · IMCO amendments 329–532 to the draft opinion: removal

Changes in context

Wording reproduced in the amendment

Amendment 330 · IMCO amendments 329–532 to the draft opinion

Changes in context

Wording reproduced in the amendment

Amendment 86 · IMCO draft opinion · Alex Agius Saliba (rapporteur): removal

Changes in context

Wording reproduced in the amendment

Amendment 229 · JURI amendments 69–296 to the draft opinion: removal