S.L. 164.4 Art. 13Liability and penalties. Cap 586.    Cap. 586. 

(1) Without prejudice to the rights of data subjects to institute an action under article 30(2) of the Data Protection Act, any person who suffers damages as a result of an unlawful personal data processing operation through the use of N.SIS or as a result of any other act incompatible with Regulation (EU) 2018/1862, may, by sworn application filed before the First Hall of the Civil Court, institute an action for damages against the authority that has conducted such unlawful personal data processing operation or such other incompatible action.

(2) Where the claim for damages as referred to in sub-

regulation (1) is made by a data subject in relation, connection or consequent to an infringement in terms of article 30(1) of the Data

Protection Act, such claim shall be made concurrently and through the same action instituted under article 30(2) of such Act.

(3) If the court, in determining an action under sub-regulation (1) and (2) decides that an authority is liable for the damage caused, that court shall determine the amount of damages due to the applicant, which shall include, but are not limited to, moral damages.

(4) Any action under this regulation shall be instituted within a period of twelve (12) months from the date when the applicant became aware, or ought to have reasonably become aware, of such unlawful personal data processing operation through the use of N.SIS or of any other act incompatible with Regulation (EU) 2018/ 1862, whichever date is earlier.

FIRST SCHEDULE

(Regulation 7)

List of authorities having access to the Schengen Information System alerts: