f) pay an administrative penalty of up to [US one million dollars] or its equivalent in Somali currency. 2. Any order made by the Authority under sub-article 1 shall be proportionate to and shall take into account: a) the gravity of the violation and its repetitive nature; b) the data controller’s efforts to comply and provide information to the Authority and data subjects; and c) the resulting harm and risk to the rights and freedoms of data subjects. Article 38: Failure to comply with an order of the Authority 1. A data controller who fails to comply with any order made under article 36 that is not the subject of a duly made and ongoing appeal under article 39 commits an offence for which such data controller is liable to a fine of [US one million dollars] or its equivalent in Somali currency and imprisonment for [two] years. 2. Liability for a fine under sub-article 1 does not release or reduce any liability arising from an order made under article 37. Article 39: Appeal of an order of the Authority 1. A data subject, data controller or other interested person who is not satisfied with an order of the Authority may apply to the Supreme Court within thirty days after the date the order was made for judicial review thereof. Article 40: Civil remedies 1. A data subject who suffers injury, loss or harm as a result of a violation of this Law by a data controller, or a consumer organisation acting on behalf of such a data subject or multiple data subjects, may recover damages by way of civil proceedings in the appropriate court from such data controller. CHAPTER IX—MISCELLANEOUS Article 41: Power to issue regulations 1. The Authority shall have the power to issue regulations published in the Official Bulletin elaborating on the provisions of this Law. 2. Without prejudice to the generality of sub-article 1, the regulations may provide for: a) the financial management of the affairs of the Authority; 28