Protection of Personal Information Act, 2013 (Act No. 4 of 2013)Chapter 10 : Enforcement99. Civil remedies |
| (1) | A data subject or, at the request of the data subject, the Regulator, may institute a civil action for damages in a court having jurisdiction against a responsible party for breach of any provision of this Act as referred to in section 73, whether or not there is intent or negligence on the part of the responsible party. |
| (2) | In the event of a breach the responsible party may raise any of the following defences against an action for damages: |
| (a) | Vis major; |
| (b) | consent of the plaintiff; |
| (c) | fault on the part of the plaintiff; |
| (d) | compliance was not reasonably practicable in the circumstances of the particular case; or |
| (e) | the Regulator has granted an exemption in terms of section 37. |
| (3) | A court hearing proceedings in terms of subsection (1) may award an amount that is just and equitable, including— |
| (a) | payment of damages as compensation for patrimonial and non-patrimonial loss suffered by a data subject as a result of breach of the provisions of this Act; |
| (b) | aggravated damages, in a sum determined in the discretion of the Court; |
| (c) | interest; and |
| (d) | costs of suit on such scale as may be determined by the Court. |
| (4) | Any amount awarded to the Regulator in terms of subsection (3) must be dealt with in the following manner: |
| (a) | The full amount must be deposited into a specifically designated trust account established by the Regulator with an appropriate financial institution; |
| (b) | as a first charge against the amount, the Regulator may recover all reasonable expenses incurred in bringing proceedings at the request of a data subject in terms of subsection (1) and in administering the distributions made to the data subject in terms of subsection (5); and |
| (c) | the balance, if any (in this section referred to as the ‘‘distributable balance’’), must be distributed by the Regulator to the data subject at whose request the proceedings were brought. |
| (5) | Any amount not distributed within three years from the date of the first distribution of payments in terms of subsection (4), accrue to the Regulator in the Regulator’s official capacity. |
| (6) | The distributable balance must be distributed on a pro rata basis to the data subject referred to in subsection (1). |
| (7) | A Court issuing any order under this section must order it to be published in the Gazette and by such other appropriate public media announcement as the Court considers appropriate. |
| (8) | Any civil action instituted under this section may be withdrawn, abandoned or compromised, but any agreement or compromise must be made an order of Court. |
| (9) | If a civil action has not been instituted, any agreement or settlement, if any, may, on application to the Court by the Regulator after due notice to the other party, be made an order of Court and must be published in the Gazette and by such other public media announcement as the Court considers appropriate. |