Personal Data Protection Act, No. 9 of 2022 39 (e) the categories of personal data affected by any contravention; (f) the manner in which a contravention became known to the Authority, in particular whether, and if so to what extent, the controller or processor notified the contravention to the Authority; (g) the previous non - compliances by such controller or processor under this Act; (h) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, arising out of or in relation to the contravention of this Act by a controller or processor as the case may be. 40. Any exemption, restriction or derogation to the provisions of this Act shall not be allowed except where such an exemption, restriction or derogation is provided for in any law and respects the essence of the fundamental rights and freedoms and constitute a necessary and proportionate measure in a democratic society for– (a) the protection of national security, defense, public safety, public health, economic and financial systems stability of the Republic of Sri Lanka; (b) the impartiality and independence of the judiciary; (c) the prevention, investigation and prosecution of criminal offences; (d) the execution of criminal penalties; and (e) the protection of the rights and fundamental freedoms of persons, particularly the freedom of expression and the right to information. Exemptions, restrictions or derogations