S26 (b) the sanction or decision of the Commission; and (c) the right to appeal. Cancellation of enforcement notice 42. (1) A data controller on whom an enforcement notice has been served may, at any time after the expiry of the period during which an appeal may be brought against that notice, apply in writing to the Commission for the cancellation or variation of that notice on the ground that, by reason of a change of circumstances all or any of the provisions of that notice need not be complied with, in order to ensure compliance with this Act. (2) If the Commission considers that all or any of the provisions of an enforcement notice need not be complied with in order to ensure compliance with this Act, it may cancel or vary the notice by written notice to the party on whom it is served. Civil remedies 43. A data subject may institute a civil action for damages in a Court having jurisdiction against a data controller for breach of any provision of this Act. PART VII GENERAL PROVISIONS Unsolicited electronic communications 44 (1) In this section “direct marketing” means communication by whatever means of any advertising or marketing material which is directed to particular data subjects. (2) A data subject is entitled at any time to require a data controller by notice, that the data controller cease, or not begin processing of personal data in respect of which the data subject is the data subject for the purposes of direct marketing. (3) If the Commission is satisfied on the application of any person who has given notice under subsection (2) that the data controller has failed to comply with the notice, the Commission may order the data controller to take such steps for complying with the notice as the Commission deems fit. (4) The Commission may regulate issues of unsolicited electronic communications as and when it deems fit in the interests of data subjects. Automated decision making 45. (1) Subject to subsection (2), a person may not be subjected to a decision which has legal effect on him, or which affects him significantly, based solely on the automated processing of personal information intended to provide a profile of certain aspects of his personality or personal habits. (2) The provisions of subsection (1) shall not apply where the decision – (a) has been taken in connection with the conclusion or performance of a contract, and (i) the request of the data subject in terms of the data contract has been met; or