29.

Power to give directions

(1) The Commission may, if it is satisfied that an organisation is not complying with any provision in Parts III to VI, give the organisation such directions as the Commission thinks fit in the circumstances to ensure compliance with that provision.
(2) Without prejudice to the generality of subsection (1), the Commission may, if it thinks fit in the circumstances to ensure compliance with Parts III to VI, give the organisation all or any of the following directions:
(a) to stop collecting, using or disclosing personal data in contravention of this Act;
(b) to destroy personal data collected in contravention of this Act;
(c) to comply with any direction of the Commission under section 28(2);
(d) to pay a financial penalty of such amount not exceeding $1 million as the Commission thinks fit.
(3) Subsection (2)(d) shall not apply in relation to any failure to comply with a provision of this Act, the breach of which is an offence under this Act.
(4) The Commission shall, in any direction requiring the payment of a financial penalty, specify the date before which the financial penalty is to be paid, being a date not earlier than the end of the period within which an application for reconsideration of the direction, or an appeal against the direction, may be brought under section 31 or 34, respectively.
(5) The interest payable on the outstanding amount of any financial penalty imposed under subsection (2)(d) and for payment by instalment (as may be directed by the Commission in its discretion) of any financial penalty imposed under subsection (2)(d) shall be at such rate as the Commission may direct, which shall not exceed the rate prescribed in the Rules of Court in respect of judgment debts.
(6) Any interest ordered to be paid under subsection (5) shall form part of the penalty payable and be enforced in accordance with section 30.