Article 64 — Criminal Offences and Sanctions

1/ Any person who a) does not to notify personal data breach b) does not implement technical and organizational measures when a breach is committed; or c) Processes personal data in contravention of the provisions of this Proclamation; Shall be punished with simple imprisonment from one to three years or fined from 60,000 – 100,000 birr or both. 2/ Any person who against the rights of the data subject a) fails to erase personal data; b) fails to respect the right to object processing; c) restricts processing; or d) Does not respect the right against automated decisions shall be punished with imprisonment for a period starting from three years to five years or fined from 100,000 – 200,000 birr or both. 3/ Any person a) Re-identifies personal data which has been de- identified; or b) Processes Re-identified personal data which is identified in Sub Article 3 let (a) of this article; c) sells or offers to sell personal data; or d) Transfers of personal data outside Ethiopia in violation of this Proclamation; shall be punished with serious imprisonment from five years to ten years or fined from 200,000 - 600,000 birr or both. 4/ Notwithstanding the provisions of Sub-Article (1), (2) and (3) of this Article, if the offence a) has been committed by an institution; or b) has caused any damage and as a result became a serious offence; [[ c) has been committed in relation to sensitive personal data; or d) has been committed in relation the personal data of a minor, the offence shall be punishable with a fine up to four per cent of its total worldwide turnover of the preceding financial year.