Reproduced by Sabinet Online in terms of Government Printer’s Copyright Authority No. 10505 dated 02 February 1998 94 No. 37067 GOVERNMENT GAZETTE, 26 November 2013 Act No. 4 of 2013 Protection of Personal Information Act, 2013 94 Cancellation of enforcement notice 96. (1) A responsible party on whom an enforcement notice has been served may, at any time after the expiry of the period during which an appeal may be brought against that notice, apply in writing to the Regulator for the cancellation or variation of that notice on the ground that, by reason of a change of circumstances, all or any of the 5 provisions of that notice need not be complied with in order to ensure compliance with the conditions for the lawful processing of personal information. (2) If the Regulator considers that all or any of the provisions of an enforcement notice need not be complied with in order to ensure compliance with a condition for the lawful processing of personal information or conditions to which it relates, it may cancel 10 or vary the notice by written notice to the responsible party on whom it was served. Right of appeal 97. (1) A responsible party on whom an information or enforcement notice has been served may, within 30 days of receiving the notice, appeal to the High Court having jurisdiction for the setting aside or variation of the notice. 15 (2) A complainant, who has been informed of the result of the investigation in terms of section 77(3) or 96, may, within 180 days of receiving the result, appeal to the High Court having jurisdiction against the result. Consideration of appeal 98. (1) If in an appeal under section 97 the court considers— 20 (a) that the notice or decision against which the appeal is brought is not in accordance with the law; or (b) that the notice or decision involved an exercise of discretion by the Regulator that ought to have been exercised differently, the court must allow the appeal and may set aside the notice or substitute such other 25 notice or decision as should have been served or made by the Regulator. (2) In such an appeal, the court may review any determination of fact on which the notice in question was based. Civil remedies 99. (1) A data subject or, at the request of the data subject, the Regulator, may institute a civil action for damages in a court having jurisdiction against a responsible party for breach of any provision of this Act as referred to in section 73, whether or not there is intent or negligence on the part of the responsible party. (2) In the event of a breach the responsible party may raise any of the following defences against an action for damages: (a) Vis major; (b) consent of the plaintiff; (c) fault on the part of the plaintiff; (d) compliance was not reasonably practicable in the circumstances of the particular case; or (e) the Regulator has granted an exemption in terms of section 37. (3) A court hearing proceedings in terms of subsection (1) may award an amount that is just and equitable, including— (a) payment of damages as compensation for patrimonial and non-patrimonial loss suffered by a data subject as a result of breach of the provisions of this Act; (b) aggravated damages, in a sum determined in the discretion of the Court; (c) interest; and 30 35 40 45