| (2) |
The contravention referred to in subsection (1) must— |
| (a) |
be of a serious or persistent nature; and |
| (b) |
likely cause substantial damage or distress to the data subject. |
| (3) |
The responsible party must— |
| (a) |
have known or ought to have known that— |
| (i) |
there was a risk that the contravention would occur; or |
| (ii) |
such contravention would likely cause substantial damage or distress to the data subject; and |
| (b) |
have failed to take reasonable steps to prevent the contravention. |
| (4) |
Whenever a responsible party is charged with an offence under subsection (1), it is a valid defence to such a charge to contend that he or she has taken all reasonable steps to comply with the provisions of section 8. |
| (a) |
to one data subject only; or |
| (b) |
jointly to more than one data subject, |
by a financial or other institution which enables the data subject, referred to in paragraph (a), to access his, her or its own funds or to access credit facilities or which enables a data subject, referred to in paragraph (b), to access joint funds or to access joint credit facilities.
Basic Conditions of Employment Act, 1997
