Data Protection Act (Cap. 586), article 30

30. (1) Without prejudice to any other remedy available to him, including the right to lodge a complaint with the Commissioner, a data subject may, where he believes that his rights under the Regulation or this Act have been infringed as a resul t of the processing of his personal data i n contravention of the provisi ons of the Regulation or this Act, by sw orn application filed before t he First Hall of the Civil Court, institute an action for an effective j udicial remedy against the controlle r or processor concerned. (2) A data subject may also, by sworn application filed before the First Hall of the Civil Court, institute an action f or damages against the controller or processor who processes perso nal data in contravention of the pr ovisions of the Regulation or th is Act. (3) If in determining an action under sub-article (2) the court finds that the controller or processor is liable for the damage caused pursuant to Article 82 of the Regulation, the court shal l determine the amount of damages, including, but not limited to, moral damages as the c ourt may determine, due to the data subje ct. (4) Any action under this article shall be instituted within a period of twelve months from the date when the data subject bec ame aware, or ought to have reasonably become aware, of such a contravention, whichever is the earlier. 18 [CAP. 586. DATA PROTECTION Actions against the Commissioner.