S9 (s) issue, approve, amend or revoke codes of conduct; (t) make and issue Guidelines to assist public or private bodies to develop codes of conduct or to apply codes of conduct; (u) impose administrative sanctions which may be punitive, depending on the facts of the matter such as the cancellation of the authorization of processing of personal information, fines or awarding of damages to the benefit of the injured data subject in the case of violation of the provisions of this Act; (v) establish mechanisms of cooperation with other authorities or other data protection authorities from other countries, for purposes of resolving cross-border disputes pertaining to data protection and information privacy; (w) review a decision made under an approved code of conduct; (x) exercise and perform such other functions or powers conferred by this Act; and (y) make such decisions and authorizations as may be necessary in carrying out the functions of the Commission. (2) The Commission may, from time to time, in the public interest or in the legitimate interests of any person or body of persons, publish reports relating to the exercise of the functions of the Commission under this Act or to any case investigated by the Commission. Powers of the Commission to impose sanctions 6. (1) The Commission may issue (a) a warning to a data controller who fails to comply with the obligations of this Act; or (b) a formal notice calling upon a data controller to comply within a specified period. (2) A warning and notice issued in term of subsection (1) shall be served on the data controller by the Commission. (3) Where the controller fails to comply with a notice issued in terms of subsection (1) (b), the Commission may (a) limit, suspend or terminate the authorization of a data collector to process personal information, issued under this Act, or (b) impose an administrative fine not exceeding five million Emalangeni (5, 000, 000.00) or 2 percentage (%) of the annual turnover of the data controller. (4) Where a person or body or persons fails to comply with the provisions of this Act the Commission may (a) cancel or suspend the authorization to process personal information; (b) impose a fine against that person or body or persons; or