(1) A person who, without the prior authority of the controller or processor -
(a) obtains personal data, and
(b) discloses the data or information to another person,
shall be guilty of an offence and shall be liable -
(i) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or
(ii) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or both.
(2) Subsection (1) does not apply to a person who shows that the disclosing was required or authorised by or under any enactment, rule of law or order of a court.
(3) A person who sells personal data that were disclosed to the person in contravention of subsection (1) shall be guilty of an offence and shall be liable -
(a) on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both, or
(b) on conviction on indictment, to a fine not exceeding €50,000 or imprisonment for a term not exceeding 5 years or
…