Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998
94
No. 37067
GOVERNMENT GAZETTE, 26 November 2013
Act No. 4 of 2013
Protection of Personal Information Act, 2013
94
Cancellation of enforcement notice
96. (1) A responsible party on whom an enforcement notice has been served may, at
any time after the expiry of the period during which an appeal may be brought against
that notice, apply in writing to the Regulator for the cancellation or variation of that
notice on the ground that, by reason of a change of circumstances, all or any of the 5
provisions of that notice need not be complied with in order to ensure compliance with
the conditions for the lawful processing of personal information.
(2) If the Regulator considers that all or any of the provisions of an enforcement
notice need not be complied with in order to ensure compliance with a condition for the
lawful processing of personal information or conditions to which it relates, it may cancel 10
or vary the notice by written notice to the responsible party on whom it was served.
Right of appeal
97. (1) A responsible party on whom an information or enforcement notice has been
served may, within 30 days of receiving the notice, appeal to the High Court having
jurisdiction for the setting aside or variation of the notice.
15
(2) A complainant, who has been informed of the result of the investigation in terms
of section 77(3) or 96, may, within 180 days of receiving the result, appeal to the High
Court having jurisdiction against the result.
Consideration of appeal
98. (1) If in an appeal under section 97 the court considers—
20
(a) that the notice or decision against which the appeal is brought is not in
accordance with the law; or
(b) that the notice or decision involved an exercise of discretion by the Regulator
that ought to have been exercised differently,
the court must allow the appeal and may set aside the notice or substitute such other 25
notice or decision as should have been served or made by the Regulator.
(2) In such an appeal, the court may review any determination of fact on which the
notice in question was based.
Civil remedies
99. (1) A data subject or, at the request of the data subject, the Regulator, may institute
a civil action for damages in a court having jurisdiction against a responsible party for
breach of any provision of this Act as referred to in section 73, whether or not there is
intent or negligence on the part of the responsible party.
(2) In the event of a breach the responsible party may raise any of the following
defences against an action for damages:
(a) Vis major;
(b) consent of the plaintiff;
(c) fault on the part of the plaintiff;
(d) compliance was not reasonably practicable in the circumstances of the
particular case; or
(e) the Regulator has granted an exemption in terms of section 37.
(3) A court hearing proceedings in terms of subsection (1) may award an amount that
is just and equitable, including—
(a) payment of damages as compensation for patrimonial and non-patrimonial
loss suffered by a data subject as a result of breach of the provisions of this
Act;
(b) aggravated damages, in a sum determined in the discretion of the Court;
(c) interest; and
30
35
40
45