Who may claim damages under this provision, from whom, and what must be shown before the controller can escape liability?
General information · Not legal advice
Material to check
In the practice file for this exercise, we read the papers showing the claimant is the data subject whose personal data was processed, the records identifying which entity processed that data as its controller, the papers describing the act said to breach the Act, and any proof of the harm said to have resulted.
These are types of material to look for, not evidence already verified by PRO SE.
Where readings differ
One reading takes the first paragraph at its words: where a personal information controller's act violates the Personal Information Protection Act and a data subject suffers harm through it, the data subject may claim damages from that controller, and the controller escapes liability only by proving the absence of intent or negligence.
Another reading notes that the provision's reach changes with the kind of violation: the court may fix damages above the ordinary measure, up to the multiple the provision sets, only where personal data was leaked or likewise lost through the controller's intent or gross negligence and harm resulted, so a breach causing harm by other means stays within the first paragraph.
Your judgment
How could the file show that the entity named as defendant is the controller of the claimant's personal data rather than a party merely processing it for another?
PRO SE does not make this decision or keep a case record on this public site.When to reconsider
We look at this again if the provision is amended to widen who may claim or to reach a processor, or if a court decision defines what counts as personal data being leaked or likewise lost.