! No. 42 Data Protection 2019 PART XI—MISCELLANEOUS PROVISIONS 72. (1) A data controller who, without lawful excuse, discloses personal data in any manner that is incompatible with the purpose for which such data has been collected commits an offence. Offences of unlawful disclosure of personal data. (2) A data processor who, without lawful excuse, discloses personal data processed by the data processor without the prior authority of the data controller commits an offence. (3) Subject to subsection (4), a person who— (a) obtains access to personal data, or obtains any information constituting such data, without prior authority of the data controller or data processor by whom the data is kept; or (b) discloses personal data to third party, commit an offence. (4) Subsection (3) shall not apply to a person who is an employee or agent of a data controller or data processor acting within the scope of such mandate. (5) A person who offers to sell personal data where such personal data has been obtained in breach of subsection (1) commits an offence (6) For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale constitutes an offer to sell the personal data. 73. (1) A person who commits an offence under this Act for which no specific penalty is provided or who otherwise contravenes this Act shall, on conviction, be liable to a fine not exceeding three million shillings or to an imprisonment term not exceeding ten years, or to both. (2) In addition to any penalty referred to in subsection (1), the Court may— (a) order the forfeiture of any equipment or any article used or connected in any way with the commission of an offence; or (b) order or prohibit the doing of any act to stop a continuing contravention. 74. (1) The Data Commissioner may, for the purpose of this Act— General penalty. Codes, guidelines and certification.