a) To suspend the processing;
b) To block certain personal data processed;
c) To temporarily or permanently prohibit any processing that is
contrary to the provisions of this Supplementary Act.
Article 20:
Sanctions
Where the data processor does not confonn with the fonnal notice addressed to
him, the protection Authority may, after procedures inter partes, take the following
sanctions against him:
1) provisional withdrawal of the authorization granted;
2) definitive withdrawal of the authorizaflon; and
3) a fine.
Artlcle 21:
Appeel
The sanctions and decisions of the Data Protection Authority may be subject to
appeal.
Article 22:
Budget
The data protection Authority shall receive a budget allocation from government
to enable it carry out its missions.
CHAPTER V:
PRINCIPLES GUIDING THE PROCESSING OF PERSONAL DATA
Article 23:
Principle of consent and legitimacy
1) Processing of personal data shall be considered legitimate where the data
subject has given his consent.
2) Nonetheless, the requirement for consent may be waived when the processing
is necessary:
a) in order to comply with a legal obligation that is binding upon the
data controller;
b) for the implementation of a public interest mission or relevant to the
exercise of public authority that is vested in the data controller or
the third party to whom the data is disclosed;