Enforcement of the PDPA is carried out by the Data Protection Authority of Sri Lanka (“Authority”). As an initial step, the PDPA provides that data subjects aggrieved by the decisions of controllers have the right appeal to the Authority. The Authority is empowered to conduct investigations, and to allow or disallow such appeals at its discretion. In the event an appeal is allowed, the controller in question is required to give effect to the decision of the Authority, and inform the action taken in line with such decision, to both the relevant data subject and the Authority.

As per the Rights and Appeals Regulations (which are still in draft form), the Authority may disallow an appeal where the Authority is satisfied that:

1. the matter relating to appeal is not within the scope provided under the PDPA;
2. the appeal was not submitted within 3 months from the date of the decision of the controller;
3. the appeal was submitted by any person or entity other than the data subject or his representative; or
4. the appeal was submitted on the same ground which was earlier refused by the Authority and there is no other reasonable ground for appeal again.

The Authority is also empowered to conduct inquiries on a complaint made, or otherwise if the Authority believes that a controller or a processor inter alia has contravened, is acting in contravention of or is likely to contravene the PDPA or any other legislation in Sri Lanka relating to processing of personal data. 

The draft Personal Data Protection (Inquiry Procedure) Regulations (“Inquiry Procedure Regulations”) published by the Authority, provides that any person aggrieved by the conduct of the controller or processor may make a complaint to the Authority, substantially in the form set out in therein. 

The Inquiry Procedure Regulations also stipulate comprehensive provisions on the manner in which the inquiry on the alleged contravention will be conducted by the Authority. 

However, it must be noted that the Inquiry Procedure Regulations are still in draft form and thus may be subject to change. 

The Authority has wide powers in conducting inquiries, which includes requiring persons to appear before it, examine persons under oath or affirmation and require the furnishing of information relating to the processing functions of a controller or processor.

Corrective Powers

Upon an inquiry where the controller or processor will be given an opportunity to be heard, the Authority is empowered to issue a binding directive which may include any one or more of the following:

• cease and refrain from the activity in question;
• take certain measured to rectify the situation;
• pay compensation to the person aggrieved.

Administrative Penalties

In the event a controller or processor fails to comply with directives issued by the Authority, the Authority may impose a penalty that will not exceed LKR ten million (10,000,000) for each non-compliance.

In imposing a penalty, the Authority will consider a number of factors, including the following:

• the nature, gravity and duration of the contravention;
• action taken by the controller or processor to mitigate the damage suffered by data subjects;
• the effectiveness of the controller’s data protection management programme;
• the degree of co-operation by the controller with the Authority, in remedying the contravention and mitigating any adverse effects;
• the categories of personal data affected by the contravention;
• whether the controller or processor notified the Authority of the contravention;
• previous contraventions by controller or processor;
• financial benefits gained or losses avoided by the contravention.

Where a controller or processor has been subject to a penalty on a previous occasion and subsequently does not conform to a directive by the Authority, in addition to the penalty, such controller or processor will be liable to pay an additional penalty of twice the amount imposed as the penalty.

If the payment of a penalty is in default, the Authority may make an ex-parte application to the Magistrate Court of Colombo for an order requiring the payment, which can be recovered as a fine imposed by such court, even if such fine exceeds the amount such courts in its ordinary jurisdiction would impose.

The PDPA however makes provisions for an appeal to the Court of Appeal to a controller or processor that is aggrieved by the imposition of a penalty, which appeal should be referred within 21 working days from the date the notice of the imposition of such penalty was communicated to such controller or processor.