The regulator said its decision was in accordance with section 57 of the Protection of Personal Information Act.