Enforcement in Tanzania
The PDPC has broad investigative and corrective powers including:
- handling data protection related complaints; and
- investigating and taking necessary steps against anything it considers affects the protection of personal data or privacy of individuals.
The PDPC is empowered to issue enforcement notices. The notice specifies the contravened provision of the PDPA, steps to be taken to remedy or eliminate the infringement, the period within which to comply (minimum 21 days), and any right to appeal.
Where the person fails to comply with the enforcement notice, the PDPC can issue a penalty notice requiring the person to pay fine to be specified in the notice. Factors considered to determine a penalty include:
- nature, gravity and duration of the infringement;
- intentionality or negligent;
- mitigating factors;
- prior infringements;
- cooperation with PDPC during investigation of the infringement;
- categories of affected data;
- notification behaviour;
- the manner in which the PDPC became aware of the infringement;
- compliance with conditions of registration and previous enforcement or penalty notices;
- adherence to approved codes; and
- the effectiveness of a penalty notice.
The maximum penalty which the PDPC may issue in the enforcement notice is Tanzania Shillings One Hundred Million (TZS 100,000,000/= approx. US$ 430,000).
The PDPC may also direct the controller or processor to pay the affected data subject compensation for infringement of the PDPA. There is no ceiling on the amount of compensation which the PDPC can award.
Disclosure of personal data without lawful excuse is a criminal offence, which on conviction carries a fine and/or imprisonment. For individuals, the minimum fine for a violation is Tanzania Shillings One Hundred Thousand (TZS 100,000, approx. US$38) and the maximum is Tanzania Shillings Twenty Million (TZS 20,000,000, approx. US$ 7,732).
The maximum term an individual may be sentenced for violating a provision under the PDPA is ten (10) years. If found in violation of the PDPA, an individual may be required to both pay a fine and serve a sentence.
For a company or corporation, the minimum fine for a violation is Tanzania Shillings One Million (TZS 1,000,000, approx. US$ 387) and the maximum is Tanzania Shillings Five Billion (TZS 5,000,000,000, approx. US$ 1,932,992).
