Any of the following persons shall be punished by imprisonment with labor for not more than five years, or by a fine not exceeding 50 million won:

1. A person who provides personal information to a third party without the consent of a data subject, in violation of Article 17 (1) 1 (including where it is applied mutatis mutandis pursuant to Article 26 (8)) even through Article 17 (1) 2 is not applicable, and a person who knowingly receives such personal information;
2. A person who uses personal information or provides personal information to a third party in violation of Article 18 (1) and (2), 27 (3), 28-2 (including where it is applied mutatis mutandis pursuant to Article 26 (8)), 19, or 26 (5) and a person who knowingly receives such personal information for a profitmaking or improper purposes;
3. A person who collects personal information of a child under 14 years of age without his or her legal representative’s consent, in violation of Article 22-2 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
4. A person who processes sensitive information, in violation of Article 23 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
5. A person who processes personally identifiable information, in violation of Article 24 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
6. A person who consolidates pseudonymized information without having been designated as a specialized institution by the Protection Commission or the head of a relevant central administrative agency, in violation of Article 28-3 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
7. A person who transfers combined information to outside the institution that has performed the combination without obtaining approval therefor from the head of the specialized institution, or provides a third party with such information, in violation of Article 28-3 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), or a person who knowingly receives such combined information for profit-making or improper purposes;
8. A person who processes pseudonymized information for the purpose of uniquely identifying an individual, in violation of Article 28-5 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8));
9. A person who divulges personal information acquired in the course of performing his or her work or provides it for any other person's use without authority in violation of subparagraph 2 of Article 59, and a person who knowingly receives such personal information for a profit-making or improper purposes;
10. A person who uses, damages, destroys, alters, forges, or divulges any other person's personal information, in violation of subparagraph 3 of Article 59.