13 (4) revoke a permission referred to in section 43, where the prerequisites for the same are no longer fulfilled or the controller acts against the permission or the rules attached to it. Section 45 — Appeal (1) The decisions of the Data Protection Ombudsman, referred to in section 40(2), and the Data Protection Board, referred to in sections 43 and 44, are subject to appeal in accordance with the provisions of the Administrative Judicial Procedure Act (586/1996). The Data Protection Ombudsman may appeal against the decision of the Data Protection Board, referred to in section 43. (2) It may be ordered in a decision of the Data Protection Board that it is to be complied with regardless of appeal, unless otherwise ordered by the appellate authority. Section 46 — Threat of a fine The Data Protection Ombudsman may impose a threat of a fine, in accordance with the Act on Threats of a Fine (1113/1990), in order to reinforce the duty to provide access to data, as referred to in section 39(1) and 39(3), and a decision made on the basis of section 40(2); the Data Protection Board may do likewise in relation to the duty to provide access to data, as referred to in section 39(1), and a decision made on the basis section 44. Chapter 10 — Miscellaneous provisions Section 47 — Liability in damages (1) The controller is liable to compensate for the economic and other loss suffered by the data subject or another person because of processing of personal data in violation of the provisions of this Act. (2) Otherwise the provisions in chapter 2, sections 2 and 3, chapter 3, sections 4 and 6 and chapters 4, 6 and 7 of the Damages Act (412/1974) apply to the liability in damages. Section 48 — Penal provisions (1) The penalty for a personal data offence is provided in chapter 38, section 9 of the Penal Code (39/1889) and for breaking into a personal data file in chapter 38, section 8 of the Penal Code. The penalty for a violation of the secrecy obligation referred to in section 33 is provided in chapter 38, section 1 or 2 of the Penal Code, unless the act is punishable under chapter 40, section 5 of the Penal Code or a more severe penalty is provided in another Act. (2) A person who intentionally or grossly negligently and contrary to the provisions in this Act: (1) fails to comply with the provisions on the definition of the purpose of the processing of the personal data, the drawing up of the description of the file, the information on data processing, the rectification of the file, the right of the data subject to prohibit the processing of data or the notification of the Data Protection Ombudsman; (2) provides false or misleading data to a data protection authority in a matter concerning a personal data file; (3) breaks the rules or regulations on the protection and destruction of personal data files; or (4) breaks a final order issued by the Data Protection Board on the basis of section 43(3), thus compromising the protection of the privacy of the data subject or his/her rights, shall be sentenced for a personal data violation to a fine, provided that a more severe penalty is not provided in another Act. Section 49 — Further provisions Further provisions on the enforcement of this act are issued by Decree. Chapter 11 — Entry into force and transitional provisions Section 50 — Entry into force (1) This Act enters into force on 1 June 1999. (2) This Act repeals the Personal Data File Act (471/1987), as later amended. However, the