Section 78

The court shall have the power to order the Data Controller or

the Data Processor to pay punitive damages in addition to the actual compensation rendered by
the court as deems fit, but shall not exceeding two times of such actual compensation amount,
by taking into account the relating circumstances such as the severity of damages incurred by
the data subject, the interest obtained by the Data Controller or the Data Processor, the
financial status of the Data Controller or the Data Processor, remedy provided by the Data
Controller or the Data Processor, or the data subject’s act in contributing to cause the damages.

The claim for compensation from the wrongful act against the Personal Data

under this Act shall be barred by prescription after the lapse of three years
from the date that the injured person know of the damages and the identity of
the Data Controller or the Data Processor who is to be liable, or after ten
years from the date of which the wrongful act against the Personal Data took place.