(Unofficial Translation) No. 136 Chapter 69 Kor Government Gazette 27 May 2019 Court shall specify the cause to believe that a person is performing or will perform an act that will cause a Cyber Threat at a critical level. The motion shall be submitted as emergency hearing motion and shall be considered by the Court without delay. Section 67 In case there is a Cyber Threat at a crisis level, it shall be in the duty and power of the National Security Council in Maintaining Cybersecurity under the laws on National Security Council and other relevant laws. Section 68 In case it is urgent and necessary and the Cyber Threat is at a crisis level, the Committee may assign to the Secretary-General the power to act, only to the extent it is necessary to prevent and remedy the damages in advance, and the motion to the Court is not required to be submitted. However, after such operations, the details of the operations shall be notified to the Competent Court without delay. In a critical or crisis case, for the benefit of preventing, assessing, coping with, suppressing, suspending, and mitigating the risks from the Cyber Threat, the Secretary-General, upon the approval of the Committee or CRC, shall have the power to request real-time information from a person related to the Cyber Threat. Such person shall cooperate with and facilitate the Committee or the CRC without delay. Section 69 A person receiving an order related to coping with a Cyber Threat may only appeal such order for Cyber Threats at a non-critical level. Chapter 4 Penalty Provisions Section 70 The officers under this Act shall not disclose or send computer data, computer traffic data, other data related to the computer system, or data of the users obtained from this Act to any person. Any officer violating shall be subject to imprisonment not exceeding three years, a fine not exceeding Baht sixty thousand, or both. Paragraph one shall not apply to act for the benefit of litigation against an offender under this Act or an offender under other laws or for the benefit of the litigation against the officer related to the exercising of unlawful authority. Section 71 Any officer under this Act negligently causing other persons to know computer data, computer traffic data, data of the users, or other data related to the computer system obtained from this Act, shall be subject to imprisonment not exceeding one year, a fine not exceeding Baht twenty thousand, or both. Section 72 Any person who knows computer data, computer traffic data, data of the users, or data related to the computer system that the officer has obtained from this Act and unlawfully discloses such data to any person shall be subject to imprisonment not exceeding two years, a fine not exceeding Baht forty thousand, or both. Section 73 Any Organization of Critical Information Infrastructure not reporting a Cyber Threat incident in accordance with section 57 without reasonable cause shall be subject to a fine not exceeding Baht two hundred thousand. Section 74 Any person not complying with the summoning letter of the Competent Officials, or not sending information to the Competent Official in accordance with section 62 (1) 20

Select target paragraph3