| (2) | The contravention referred to in subsection (1) must— |
| (a) | be of a serious or persistent nature; and |
| (b) | likely cause substantial damage or distress to the data subject. |
| (3) | The responsible party must— |
| (a) | have known or ought to have known that— |
| (i) | there was a risk that the contravention would occur; or |
| (ii) | such contravention would likely cause substantial damage or distress to the data subject; and |
| (b) | have failed to take reasonable steps to prevent the contravention. |
| (4) | Whenever a responsible party is charged with an offence under subsection (1), it is a valid defence to such a charge to contend that he or she has taken all reasonable steps to comply with the provisions of section 8. |
| (a) | to one data subject only; or |
| (b) | jointly to more than one data subject, |
by a financial or other institution which enables the data subject, referred to in paragraph (a), to access his, her or its own funds or to access credit facilities or which enables a data subject, referred to in paragraph (b), to access joint funds or to access joint credit facilities.
