Article 38 1-Without prejudice to the rights of bona fide third parties, the competent court may order the confiscation of funds obtained as a result of committing the violations stipulated in the Law. 2-The competent court, or the committee referred to in paragraph (2) of Article (36), as the case may be, may include in their penalty judgment or decision a provision that a summary of such judgment or decision shall be published at the expense of the violator in one (or more) local newspapers distributed in their area of residence, or using any other proper means. This is based on the type, seriousness and impact of the violation; provided that the publishing shall be after the judgment becomes final, the lapse of the deadline for appeals, or the issuance of a final ruling dismissing the appeal against the judgement. Article 39 Without prejudice to the provisions of Article (35) and Paragraph (1) of Article (36) of this Law, the Public Entity shall discipline any of its employees who violate any of the provisions of this Law and Regulations, in accordance with the disciplinary provisions and procedures prescribed by law. Article 40 Without prejudice to the penalties stated in this Law, any individual that suffers a damage as a result of any of the violations stated in this Law or the Regulations may apply to a competent court for proportionate compensation for the material or moral damage. Article 41 Any person that engages in the Processing of Personal Data shall protect the confidentiality of the Personal Data even after the end of such person’s occupational or contractual relationship. Article 42 The president of the Competent Authority shall issue the Regulations within a period not exceeding (seven hundred and twenty) days commencing on the date of publishing the Law provided that the president must coordinate before issuing the Law with: (Ministry of Communications and Information Technology, Ministry of Foreign Affairs, Communications, Space & Technology Commission, Digital Government Authority, National Cybersecurity Authority, Saudi Health Council, and Saudi Central Bank), each in its own jurisdiction.