a) To suspend the processing; b) To block certain personal data processed; c) To temporarily or permanently prohibit any processing that is contrary to the provisions of this Supplementary Act. Article 20: Sanctions Where the data processor does not confonn with the fonnal notice addressed to him, the protection Authority may, after procedures inter partes, take the following sanctions against him: 1) provisional withdrawal of the authorization granted; 2) definitive withdrawal of the authorizaflon; and 3) a fine. Artlcle 21: Appeel The sanctions and decisions of the Data Protection Authority may be subject to appeal. Article 22: Budget The data protection Authority shall receive a budget allocation from government to enable it carry out its missions. CHAPTER V: PRINCIPLES GUIDING THE PROCESSING OF PERSONAL DATA Article 23: Principle of consent and legitimacy 1) Processing of personal data shall be considered legitimate where the data subject has given his consent. 2) Nonetheless, the requirement for consent may be waived when the processing is necessary: a) in order to comply with a legal obligation that is binding upon the data controller; b) for the implementation of a public interest mission or relevant to the exercise of public authority that is vested in the data controller or the third party to whom the data is disclosed;