Anyone who processes or has processed personal information shall be prohibited from engaging in any of the following activities:

1. To acquire personal information or to obtain consent to personal information processing by fraud or other improper means;
2. To divulge personal information acquired in the course of performing his or her work, or to provide it for any third party’s use without authority;
3. To use, damage, destroy, alter, forge, or divulge any other person’s personal information without legitimate authority or beyond proper authority.