Document Generated: 2022-06-22 Status: This is the original version (as it was originally made). (e) details about the independent review process set up under regulation 19 and how the right to review may be exercised; and (f) the consequences of failing to make payment within the payment period. (4) A competent authority or the Information Commissioner may withdraw a penalty notice by informing the person upon whom it was served in writing. (5) The sum that is to be imposed under a penalty notice served under this regulation must be an amount that— (a) the competent authority or Information Commissioner determines is appropriate and proportionate to the failure in respect of which it is imposed; and (b) is in accordance with paragraph (6). (6) The amount that is to be imposed under a penalty notice must— (a) not exceed £1,000,000 for any contravention which the enforcement authority determines could not cause a NIS incident; (b) not exceed £3,400,000 for a material contravention which the enforcement authority determines has caused, or could cause, an incident resulting in a reduction of service provision by the OES or RDSP for a significant period of time; (c) not exceed £8,500,000 for a material contravention which the enforcement authority determines has caused, or could cause, an incident resulting in a disruption of service provision by the OES or RDSP for a significant period of time; and (d) not exceed £17,000,000 for a material contravention which the enforcement authority determines has caused, or could cause, an incident resulting in an immediate threat to life or significant adverse impact on the United Kingdom economy. (7) In this regulation— (a) “a material contravention” means a failure to take steps, or any adequate steps, within the stipulated time period to rectify a failing that is described in regulation 17(1)(a) to (d) or (2)(a) to (e); (b) “enforcement authority” means the designated competent authority for an OES or the Information Commissioner for RDSPs. Independent review of designation decisions and penalty decisions 19.—(1) If an OES so requests, the relevant competent authority for an OES must appoint an independent person (“the reviewer”) to conduct reviews of a designation or penalty decision made by that authority in relation to that OES. (2) The Information Commissioner must appoint an independent person (“the reviewer”) to conduct a review of a penalty decision made by the Commissioner in relation to an RDSP, if the RDSP requests a review to be conducted. (3) An OES may request the reviewer to review a designation or penalty decision made in relation to that OES in order to challenge any of the following matters— (a) the basis upon which the designation decision was made; (b) the grounds for imposing a penalty notice; (c) the sum that is imposed by way of a penalty notice; (d) the time period within which the penalty notice must be paid. (4) A RDSP may request the reviewer to conduct a review of a penalty decision made in relation to that RDSP in order to challenge any of the following matters— (a) the grounds for imposing a penalty notice; 17