(Unofficial Translation) No. 136 Chapter 69 Gor Government Gazette 27 May 2019 Section 76 In order to act in accordance with this Act, the Competent Officer shall have the following duties and power: (1) request the Data Controller, the Data Processor, or any person in writing, to provide information or submit any documents or evidence in connection with the actions or offenses under this Act; (2) investigate and collect facts, and report to the expert committee in the event that the Data Controller, the Data Processor, or any person, has committed an offense or caused damage due to their violation of or non-compliance with this Act or notifications issued in accordance with this Act. In carrying out the duty in (2), if there is a necessity to protect the benefits of the data subject or for public's interest, the Competent Officer shall file a compliant to the competent court to issue an order granting permission to the Competent Officer to enter the premises of the Data Controller, or any person involved in the offense under this Act, during the interval between sunrise and sunset or during the business hours of such premises, to investigate and collect facts, seize, or attach documents, evidence, or any other items related to the offense, or which has a cause to believe that they are used to commit such offense. In order to appoint the Competent Officer, the Minister shall consider appointing such person from the civil officials or other government officials whose position is not lower than a civil official at the operational level or equivalent, and having the qualifications in accordance with the notification issued by the Committee. During the performance of his or her duties under this Section, the Competent Officer shall present his or her identification card to the relevant persons and be provided with reasonable facilitation by the relevant persons. The identification card of the Competent Officer shall be in accordance with the form required by the notification of the Committee. Chapter VI Civil Liability --------------------------Section 77 The Data Controller or the Data Processor, whose operation in relation to Personal Data violates or fails to comply with the provisions of this Act which causes damages to the data subject, shall compensate the data subject for such damages, regardless of whether such operation is performed intentionally or negligently, except where the Data Controller or the Data Processor can prove that such operation was a result of: (1) a force majeure, or the data subject’s own act or omission to act; (2) an action taken in compliance with an order of a government official exercising its duties and power under the law; The compensation under paragraph one includes all necessary expenses incurred by the data subject for the prevention of the damages likely to occur, or which was spent to suppress the damages occurred. Section 78 The court shall have the power to order the Data Controller or the Data Processor to pay punitive damages in addition to the actual compensation rendered 29