51 2018 Computer Misuse and Cybercrimes No. 5 (3) Prior to the sharing of information under subsection (1), a party to an agreement shall review the information and ascertain whether the information contains personal details that may identify a specific person not directly related to a threat that amounts to a computer and cybercrime and remove such information. (4) A person shall not, under this Part, share information relating to the health status of another person without the prior written consent of the person to whom the information relates. 13. (1) The owner or person in control of a critical information infrastructure shall annually submit a compliance report on the critical information infrastructure to the Committee in line with a critical infrastructure framework in order to evaluate compliance. (2) The Director, shall within a reasonable time before an audit on a critical information infrastructure or at any time there is an imminent threat in the nature of an attack that amounts to a computer and cybercrime, notify the owner or person in control of a critical information infrastructure in writing — (a) the date on which an audit is to be performed; and (b) the particulars and contact details of the person who is responsible for the overall management and control of the audit. (3) The Director shall monitor, evaluate and report on the adequacy and effectiveness of any audit. (4) The Director may request the owner or person in control of a critical information infrastructure to provide such additional information as may be necessary within a specified period in order to evaluate the issues raised from the audit. (5) An owner or authorised person in control of a critical information infrastructure commits an offence and if convicted is liable to a fine not exceeding two hundred thousand shillings or to term of imprisonment not exceeding five years or both if the owner or authorized person — (a) fails to file a compliance report and fails to cooperate with an audit to be performed on a critical information infrastructure in order to evaluate compliance with the directives issued; Auditing of critical information infrastructures to ensure compliance.