Personal Data Protection Act GN. NO. 395B (Contd) without the prior authority of the data controller commits an offence. (3) Subject to subsection (4), a person who(a) obtains personal data, or obtains any information constituting personal data, without prior authority of the data controller or data processor by whom the personal data is kept; or (b) discloses personal data to third party, commits an offence. (4) A person who offers for sale personal data of another person obtained in breach of subsection (1) commits an offence. (5) For the purposes of subsection (4), an advertisement indicating that personal data is or may be for sale, constitutes an offer for sale of the personal data. (6) A person who commits an offence under this section shall, upon conviction, be liable to(a) in the case of an individual, a fine of not less than one hundred thousand shillings but not exceeding twenty million shillings or to imprisonment for a term not exceeding ten years or both; and (b) in the case of a company or corporation, a fine of not less than one million shillings but not exceeding five billion shillings. Offences of unlawful destruction, deletion, concealment or alteration of personal data 61. A person who unlawfully destroys, deletes, misleads, conceals or alters personal data commits an offence and shall, upon conviction, be liable to a fine of not less than one hundred thousand shillings but not exceeding ten million shillings or to imprisonment for a term not exceeding five years or both. Offences by company or corporation 62. Where an offence under this Act is committed by a company or corporation, the company or corporation and every officer of the company or corporation who knowingly and willfully authorises or 35