Article 40

6a.The infringements of the obligations laid down in Chapter VIIc shall be subject to effective, proportionate and dissuasive administrative penalties. Member States shall designate the authorities competent to impose such penalties and shall ensure that they may, in particular, sanction the unlawful transfer of data to third countries, the re-identification of pseudonymised or anonymised data, and any misuse of data re-used under that Chapter. The criteria set out in paragraph 3 shall apply.

For infringements of the obligations laid down in Chapter VIIc, the competent authorities responsible for monitoring the application of that Chapter may, within their scope of competence, impose administrative fines in accordance with national law. The rules on penalties referred to in paragraph 1 shall apply, in particular, to:

(a)the re-use of data or documents in breach of lawfully imposed conditions or for purposes other than those authorised;

(b)the unlawful transfer or onward transfer of data or documents to a third country, or failure to comply with the related information, notification, transparency or safeguard requirements;

(c)failure to comply with obligations protecting intellectual property rights, trade secrets, statistical or commercial confidentiality or other protected data;

(d)the conclusion, maintenance or performance of an exclusivity arrangement prohibited by, or incompatible with, Chapter VIIc;

(e)the intentional or negligent provision of materially inaccurate, incomplete or misleading information in order to obtain a right of re-use;

(f)failure to delete or return data or documents, or to cease their use or re-use, where the applicable conditions are no longer met.

In addition to administrative fines, the competent authorities may, in accordance with national law and where necessary and proportionate, suspend or withdraw the right of re-use, temporarily prohibit new requests for re-use, or order the cessation, deletion or return of the data or documents concerned. When determining the type and level of penalties or other measures, the competent authorities shall take into account the criteria set out in paragraph 3 and, where relevant, the intentional or negligent character of the infringement, any transfer to a third country, the sensitive or strategic nature of the data or documents concerned, and any adverse impact on public or economic security, critical infrastructure, essential services or the essential interests of a Member State.

7.When applying paragraph 6 to microenterprises and small and medium-sized enterprises, the competent authorities shall take into account their size, economic capacity and any corrective measures taken without undue delay. This shall not preclude effective, proportionate and dissuasive penalties for intentional, repeated or serious infringements.'