(1) Where a data subject suffers injury by reason of the failure of a person to comply with any requirement imposed under this Act or the Regulations, the person is liable to the data subject in an amount equal to the sum of —
(a) the actual damages sustained by the data subject by reason of the failure; and
(b) in the case of a successful action to enforce liability under this section, the cost of the action as the High Court may determine.
(2) Where two or more directors or officers of a credit bureau or other entity are liable in respect of a failure under subsection (1), their liability shall be joint and several.
(3) In any civil proceeding under this Act against a credit bureau or a credit information provider in respect of an error respecting the credit information of a data subject, it shall be a defence for the credit bureau or, as the case may be, the credit information provider to show that the credit bureau or a credit information provider is not the source of the error.