12 THE GAZETTE OF INDIA EXTRAORDINARY [P ART II— records, made in the interest of national security in pursuance of a direction of an officer not below the rank of Joint Secretary to the Government of India specially authorised in this behalf by an order of the Central Government: Provided that every direction issued under this sub-section, shall be reviewed by an Oversight Committee consisting of the Cabinet Secretary and the Secretaries to the Government of India in the Department of Legal Affairs and the Department of Electronics and Information Technology, before it takes effect: Provided further that any direction issued under this sub-section shall be valid for a period of three months from the date of its issue, which may be extended for a further period of three months after the review by the Oversight Committee. CHAPTER VII OFFENCES AND PENALTIES Penalty for impersonation at time of enrolment. 34. Whoever impersonates or attempts to impersonate another person, whether dead or alive, real or imaginary, by providing any false demographic information or biometric information, shall be punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees or with both. Penalty for impersonation of Aadhaar number holder by changing demographic information or biometric information. 35. Whoever, with the intention of causing harm or mischief to an Aadhaar number holder, or with the intention of appropriating the identity of an Aadhaar number holder changes or attempts to change any demographic information or biometric information of an Aadhaar number holder by impersonating or attempting to impersonate another person, dead or alive, real or imaginary, shall be punishable with imprisonment for a term which may extend to three years and shall also be liable to a fine which may extend to ten thousand rupees. Penalty for impersonation. 36. Whoever, not being authorised to collect identity information under the provisions of this Act, by words, conduct or demeanour pretends that he is authorised to do so, shall be punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both. Penalty for disclosing identity information. 37. Whoever, intentionally discloses, transmits, copies or otherwise disseminates any identity information collected in the course of enrolment or authentication to any person not authorised under this Act or regulations made thereunder or in contravention of any agreement or arrangement entered into pursuant to the provisions of this Act, shall be punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both. Penalty for unauthorised access to the Central Identities Data Repository. 38. Whoever, not being authorised by the Authority, intentionally,— (a) accesses or secures access to the Central Identities Data Repository; (b) downloads, copies or extracts any data from the Central Identities Data Repository or stored in any removable storage medium; (c) introduces or causes to be introduced any virus or other computer contaminant in the Central Identities Data Repository; (d) damages or causes to be damaged the data in the Central Identities Data Repository; (e) disrupts or causes disruption of the access to the Central Identities Data Repository; (f) denies or causes a denial of access to any person who is authorised to access the Central Identities Data Repository;