38. Imposition of penalties

Where a controller or processor fails to comply with a directive issued under the provisions of section 35, the Authority shall after taking into consideration the impact on data subjects, the nature and extent of relevant non-compliances and the matters referred to in section 39 of this

Where a controller or processor has been subjected to a penalty on a previous occasion, subsequently fails to conform to a directive on any further occasion such person shall in addition to the penalty which may be imposed on him under subsection (1) be liable to the payment of an additional penalty consisting of twice the amount imposed as a penalty on the second and for each subsequent non-compliance.

The Authority shall be responsible for the collection of a penalty imposed under this section and the money so collected shall be credited to the Consolidated Fund after deducting such sum of money collected as compensation if any payable to the aggrieved person affected by reason of the non-compliance of the provisions of paragraph (c) of subsection (2) of section 35.

If a controller or processor becomes liable to a penalty in terms of subsection (1) or (2) fails to pay such penalty, within such period as may be specified in such notice, the

The imposition of a penalty under this section shall not preclude a relevant regulatory or statutory body from taking any other regulatory measures including, but not limited to, the suspension of such controller or processor from carrying on of a business or profession or the cancellation of a licence or authority granted for the carrying on of a business or profession, as may be permitted in terms of any applicable written law or rules for the regulation or supervision of such controller or processor.

Where a penalty is imposed under this section on a body of persons, then–

A controller or processor who is aggrieved by the imposition of an administrative penalty under this section, may appeal against such decision to the Court of Appeal within twenty-one working days, from the date of the notice of the imposition of such administrative penalty was communicated to such person.

Until rules are made under Article 136 of the

Any controller or processor who prefer an appeal to the Court of Appeal under subsection (7), shall, deposit in cash as a security such sum of money equal to the penalty imposed under subsections (1) or (2) before the registrar of the Court of Appeal.

Where an appeal is preferred under subsection (7), the burden of proof shall be on the controller or the processor as the case may be, to prove that he has acted in compliance with the provisions of this Act.