(d) (e) (f) (g) (h) (i) 67. (1) (2) (3) 68. (1) (2) 69. (1) transparency and accountability measures implemented by the data controller or the data processor, as the case may be, including adherence to any relevant code of practice relating to security safeguards; action taken by the data controller or the data processor, as the case may be, to mitigate the damage suffered by the data subject; previous history of any, or such, violation by the data controller or the data processor, as the case may be; whether the arrangement between the data controller and data processor contains adequate transparency and accountability measures to safeguard the personal data being processed by the data processor on behalf of the data controller; the accrual of undue benefits which can be measured; and any other aggravating or mitigating factor relevant to the circumstances of the case, such as, the amount of disproportionate gain or unfair advantage, wherever quantifiable, made as a result of the default. Administrative Sanctions Failure to perform the duties stipulated in this Proclamation, regulations, directives and codes of practices issued to implement this Proclamation shall constitute an administrative offence. When the offence has been committed (a) by an institution, (b) in relation to sensitive data, or (c) the personal data of a child, the offence shall be punishable to a fine up to four per cent of its total worldwide turnover of the preceding financial year. The local turnover of the company shall make up part of the worldwide turnover of the company. The Commission may determine by a directive a list of administrative offences and their corresponding sanctions. Administrative Complaints Anyone who has a complaint against a decision rendered by a data controller or data processor shall have the right to make an administrative complaint to the Commission within twenty one days of such decision. The Commission after hearing the complaint shall render its decision in writing within twenty one days. Decisions on Administrative Complaints The Commission (a) shall upon receiving the notice of appeal inform the data controller concerned and any other affected person of the notice of appeal. (b) may dismiss the complaint if it holds that it is not supported by enough evidence. (c) may, if it deems necessary, authorize a mediator to handle the appeal. 30