Personal Data Protection and Safeguarding Draft Act June 2019 Section 2: Civil responsibilities Article 61. The controller up on the request of the person affected by the damage is responsible to provide reparation for the person subject of data. If this is not done, the person affected by the damage can follow up via judicial authorities. Subsection 1: Material reimbursement Article 62. When an individual associated with a corporation brings damage to someone, it is the corporation that will be responsible for the cost. Unless the corporation is able to prove that the individual acted outside his or her authority and that the corporation didn’t fail to supervise how well he or she was doing the job. Article 63. If the person who is subject of data gets his/her rights unjustly and brings damage to another person, he or she will be responsible. Article 64. Based on the kind and extent of the damage brought to reputation, the amount of damage or the financial cost brought by it, relevant judicial or law enforcement authorities can require the party who has brought the damage to pay financial penalty or accept social limitations. The manual to determine financial cost incurred by illicit processing of personal data and to show ways in which a reputation damaged by spiritual hurt can be restored and what penalties can be impressed will be suggested by expert working groups and ratified by the commission. Section 3: Penal responsibilities Subsection 1: Crimes and penalties Article 65. The penalty deemed out in this law will only be implemented if other law doesn't stipulate a heavier punishment for these crimes. Article 66. Any reference to data that has resulted from violating the regulations of this law is illegal and will be punished with fifth degree sentences. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 54 of 58