Data Protection No. 24 of 2019 [Subsidiary] (b) where a valid address to which the recipient of the communication may send a request that such communications cease has not been provided; or (c) where there is use of automated calling systems without human intervention. (4) A data controller or data processor who uses personal data for commercial purposes without the consent of the data subject commits an offence and is liable, on conviction, to a fine not exceeding twenty thousand shillings or to a term of imprisonment not exceeding six months, or to both fine and imprisonment. 16. Features of an opt out message (1) An opt out mechanism contemplated under regulation 15(1)(d) shall— (a) have a visible, clear and easily understood explanation of how to opt out; (b) include a process for opting out that requires minimal time and effort; (c) provide a direct and accessible communication channel; (d) be free of charge or where necessary involve a nominal cost to a data subject; and (e) be accessible to persons with a disability. (2) Where a data subject has opted out, a data controller or data processor shall not use or disclose their personal data for the purpose of direct marketing, in accordance with the data subject’s request. 17. Mechanisms to comply with opt out requirement (1) In communicating with a data subject on direct marketing, a data controller or data processor shall include a statement which is prominently displayed, or otherwise draws the attention of the data subject to the fact that the data subject may make an opt out request. (2) A data controller or data processor may, in complying with an opt out requirement— (a) clearly indicate, in each direct marketing message, that a data subject may opt out of receiving future messages by replying with a single word instruction in the subject line; (b) ensure that a link is prominently located in the email, which takes a data subject to a subscription control centre; (c) clearly indicate that a data subject may opt out of future direct marketing by replying to a direct marketing text message with a single word instruction; (d) inform the recipient of a direct marketing phone call that they can verbally opt out from any future calls; and (e) include instructions on how to opt out from future direct marketing, in each message. (3) A data controller or a data processor may use an opt out mechanism that provides a data subject with the opportunity to indicate their direct marketing communication preferences, including the extent to which they wish to opt out. (4) Despite sub-regulation (3), a data controller or data processor shall provide a data subject with an option to opt out of all future direct marketing communications as one of outlined preferences. 18. Request for restriction of further direct marketing (1) A data subject may request a data controller or data processor to restrict use or disclosure of their personal data, to a third party, for the purpose of facilitating direct marketing. (2) No fee shall be charged to a data subject for making or giving effect to a request under this Part. (3) A data controller or data processor shall restrict use or disclosure of personal data for the purpose of facilitating direct marketing by a third party within seven days of the request. 25