a)
b)
c)
d)
omits to send notification pursuant to section 31,
processes personal data without the necessary licence pursuant to section 33,
violates the conditions laid down pursuant to sections 35 or 46,
omits to comply with orders of the Data Inspectorate pursuant to sections 12, 27,
28 or 46,
e)
processes personal data contrary to sections 13, 15, 26 or 39, or
f)
omits to provide information pursuant to sections 19, 20, 21, 40 or 44,
shall be liable to fines or imprisonment for a term not exceeding one year or both.
In particularly aggravating circumstances, a sentence of imprisonment for a term
not exceeding three years may be imposed. In deciding whether there are particularly
aggravating circumstances, emphasis shall be placed, inter alia on the risk of great
damage or inconvenience to the data subject, the gain sought by means of the violation,
the duration and scope of the violation, manifest fault, and on whether the controller has
previously been convicted of violating similar provisions.
An accomplice shall be liable to similar penalties.
In regulations issued pursuant to this Act, it may be prescribed that any person
who wilfully or through gross negligence violates such regulations shall be liable to
fines or imprisonment for a term not exceeding one year or both.
Section 49 Compensation
The controller shall compensate damage suffered as a result of the fact that
personal data have been processed contrary to provisions laid down in or pursuant to
this Act, unless it is established that the damage is not due to error or neglect on the part
of the controller.
Controllers who provide credit information and who have communicated
information which proves to be inaccurate or obviously misleading shall compensate
any damage that has been suffered as a result of the erroneous communication,
regardless of whether the damage is due to error or neglect on the part of the controller.
The compensation shall be equivalent to the financial loss incurred by the
injured party as a result of the unlawful processing. The controller may also be ordered
to pay such compensation for damage of a non-economic nature (compensation for nonpecuniary damage) as seems reasonable.
Chapter IX Commencement. Transitional provisions. Amendments to other
statutes.
Section 50 Commencement
This Act shall enter into force from the date decided by the King. The King may
decide that the individual provisions of the Act shall enter into force on different dates.
Section 51 Transitional provisions
1.
In respect of processing of personal data which commenced prior to the entry
into force of this Act and which is subject to notification and licensing pursuant
to the provisions of Chapter VI, notification shall be sent pursuant to section 31
or an application shall be made to the Data Inspectorate for a licence pursuant to
section 33 not later than one year after the entry into force of this Act. If the
processing is being carried out in accordance with a licence pursuant to section 9
of the Personal Data Filing System Act, the time limit for sending notification or
applying for a licence shall be two years from the date of entry into force. Until