S29 Appeals 49. (1) Subject to the exhaustion of the appeal offered through the Commission under this Act, a data subject shall be entitled to pursue legal appeals with the relevant judicial authorities. (2) A data controller on whom an enforcement notice has been served, may, within thirty (30) days of receiving the notice apply to a Court having competent jurisdiction for the setting aside or variation of the notice. (3) A complainant, who has been informed of the result of the investigation may, within thirty (30) days of receiving the result appeal to the High Court against the result of the investigation. Class actions 50. The Commission shall set up a class action system to assist the data subjects in the exercise of their rights set up under this law. Whistleblowing 51. (1) The Commission shall establish rules regulating whistleblowing, giving the authorization for, and governing the whistleblowing system. (2) These rules shall preserve – (a) the principles of fairness, lawfulness and purpose of the processing; (b) the principles related to the proportionality as the limitation of the scope, accuracy of the data which will be processed; (c) the principle of openness with delivering an adequate collective and individual information on – (i) the scope and purpose of the whistleblowing; (ii) the processing of reporting; (iii) the consequences of the justified and unjustified reporting; (iv) the way of exercising the rights of access, to rectification, deletion as well as the competent authority to which a request can be made; (v) the third party which may receive personal data concerning the informer and the person who is implicated in the scope of the processing of the reporting. (2) A person who is implicated shall be informed as soon as possible of the existence of the reporting and about the facts which that person is accused of in order to exercise the rights under this law including (a) the technical and organizational rules;