[FINAL] will have the flexibility to be able to make an assessment based on their own judgement, the evidence available, and the impact of the contravention. The Government continues to believe that the principle of linking NIS penalties with the GDPR is right approach as the impact of an incident under NIS could have significant impact on the economy or an individual to an equal or greater extent than GDPR (significant damage to the economy or even loss of life). However, the Government also recognises and agrees with some of the counter arguments made by respondents through the consultation, such as: ○ ○ ○ ○ that there is a large disparity between UK’s approach and that of some other Member States; that there is a risk that companies may disinvest, although not to the extent raised; that the regime as set out may impact on the willingness of companies to voluntarily report; That the two penalty bands are not appropriately balanced. The Government has therefore decided to amend the proposed penalty regime as follows: The percentage of global turnover element will be removed from the proposed regime. The Government believes that this is what is causing the most concern for industry, and agrees that this may be considered disproportionate, especially when considered against other Member State penalty regimes. The upper limit of penalties will be maintained at £17 million. However, the two penalty bands will be merged into a single band that will cover all contraventions. The Government’s expectation is that the maximum penalty levels are precisely that, and should be reserved for the most severe cases, in an appropriate and proportionate manner. Based on this revised approach the penalty regime for the NIS regulation will be: ● a maximum financial penalty of £17m, which will cover all contraventions, such as (for example) failure to cooperate with the competent authority, failure to report a reportable incident, failure to comply with an instruction from the competent authority, failure to implement appropriate and proportionate security measures. As stated above, the Government believes that there is a need for a significant penalty regime and that amending the penalty regime in this manner will deliver this for the UK, whilst addressing the concerns raised by industry, and reiterates its view that penalties are a last resort. The Government understands the perceived concern over double jeopardy, in particular in relation to the General Data Protection Regime (GDPR). The Government agrees that Operators and Digital Service Providers should not be tried for the same offence twice, but notes that there may be reason for them to be penalised under different regimes for the same event because the penalties might relate to different aspects of the wrongdoing and different impacts. This will apply not just to GDPR but other sectoral and national legislation such as safety legislation or service commitments. The Government does not believe that ‘double jeopardy’ can be completely removed, without undermining either the NIS Regulations or other UK legislation. However, in order to take these considerations into account, the NIS Regulations will include text which will encourage Competent Authorities to work with regulators in the event of different regimes Page 16