(2) (3) (4) (5) 65. (1) (2) 66. (1) (2) Commission may serve an enforcement order on him requiring him to take such steps within such period as may be specified in the order. An enforcement order served under sub-Article (1) of this Article shall: (a) specify the provision of this Proclamation which has been, is being or is likely to be contravened; (b) specify the measures that shall be taken to remedy or eliminate the situation which makes it likely that a contravention will arise; (c) specify a period which shall not be less than 21 days within which those measures shall be implemented; and (d) state that a right of appeal is available. On complying with an enforcement order, the data controller or data processor, as the case may be, shall, within the period set, notify: (a) the data subject concerned; and (b) where such compliance materially modifies the data concerned, any person to whom the data was disclosed during the period beginning 12 months before the date of the service of the order and ending immediately before compliance, of any amendment. Where the Commission considers that any provision of the enforcement order may not be complied with to ensure compliance with this Proclamation, it may vary the order and, where it does so, it shall give written notice to the person on whom the order was served. The information order shall state that the person to whom the order is addressed has a right of appeal against the requirement specified in the order within the period specified under sub-Article (3) lit. (c) of this Article. Power to Obtain Information The Commission may, by a written information order served on any data controller or data processor, request that person, unless it violates public interest, to furnish to it in writing information in the time specified. The information requested under sub-Article (1) of this Article shall be produced or given access to the Commission in a form in which it can be taken away, is intelligible and is retrievable. Principles of Imposing Administrative Fines The Commission shall ensure that the imposition of administrative fines pursuant to this Proclamation is effective, proportional and dissuasive. While deciding to impose administrative fines, the Commission shall have due regard, inter alias, to the following factors, namely (a) nature, duration and extent of violation of the provisions of the Proclamation, regulations specified thereunder; (b) nature and extent of harm suffered by the data subject; (c) intentional or negligent character of the violation; 29