Part 6: Enforcement Section 169: Compensation for contravention of other data protection legislation
This section provides in subsection (1) that a person has the right to compensation from a controller or processor if they suffer damage because of a contravention of the data protection legislation. This section does not apply to compensation for a contravention of the GDPR, which is dealt with separately in section 168. As with section 168 this right to receive compensation is broadly equivalent to section 13 of the 1998 Act, with the exception that the type of damage which can be claimed is broader than that provided for in the 1998 Act.
	Subsection (2) sets out the situations in which a controller or processor is liable for damage. A controller is liable for the damage caused by processing if they are involved in the processing. A processor is liable for damage caused by processing which they are involved in only if they have acted in breach or outside of the controller’s lawful instructions, or alternatively if they have not complied with an obligation under the data protection legislation which is specifically directed at processors.
	Subsection (3) explains that a controller or processor is not liable for the damage if they can prove that they are not responsible in any way for the event giving rise to the damage.
	Subsection (4) provides that where there are joint controllers under Part 3 or Part 4 whose responsibilities have been determined in accordance with the relevant provisions in Part 3 or Part 4, a controller is only liable for damage if that controller is responsible for complying with the provision of the data protection legislation which has been breached.
	Subsection (5) sets out the same definition of damage which applies to section 168, which includes distress. The inclusion of a definition of damage for the purpose of this section should not be taken to impact in any way on the meaning of "damage" in any other section in the Act.