Personal Data Protection Act GN. NO. 395B (Contd) (g) the manner in which the failure became known to the Commission, including whether the data controller or data processor notified the Commission of the failure; (h) the extent to which the data controller or data processor has complied with previous enforcement notices or penalty notices; (i) adherence to codes of ethics or terms and conditions of registration; (j) whether the penalty would be effective; and (k) any other aggravating or mitigating factor applicable to the case, including financial benefits gained, or losses suffered, as a result of the failure, whether directly or indirectly. Administrative fines 47. The maximum amount of the penalty that may be imposed by the Commission in a penalty notice in relation to contravention of provisions of this Act is one hundred million shillings. Review of decision 48.-(1) The Commission may, upon application or on its own motion, review its decision or direction given in accordance with the provisions of this Part. (2) After review of the decision under subsection (1), the Commission may reverse, alter or revoke its decision or direction previously issued. Right of appeal 49. A person who is aggrieved with the administrative action taken by the Commission, including the directions given in the enforcement notice or penalty imposed in the penalty notice, may appeal to the High Court. Payment of compensation 50.-(1) Subject to the provisions of section 37, the Commission may, in addition to any penalty given under this Act, order a data controller or data processor who causes damages to the data subject following contraventions of any provisions of this Act to pay 30