(1) Any of the following persons shall be punished by imprisonment with labor for not more than two years or by a fine not exceeding 20 million won:

1. A person who fails to take necessary measures, such as correction and erasure, in violation of Article 36 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), and keeps on using the personal information or provides it to a third party;
2. A person who fails to suspend the processing of personal information, in violation of Article 37 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)), and keeps on using the personal information or provides it to a third party;
3. Any person who fails to comply with a confidentiality order under Article 39-4 in or outside Korea without good cause;
4. A person who refuses to submit materials or submits false materials in response to a request for the submission of materials under Article 63 (1) (including where it is applied mutatis mutandis pursuant to Article 26 (8)) for the purpose of concealing or understating violations of the Act;
5. A person who refuses, obstructs, or evades an investigation by concealing, discarding, or refusing access to, materials, or by forging or falsifying, etc. materials during an entry and inspection conducted pursuant to Article 63 (2) (including where it is applied mutatis mutandis pursuant to Article 26 (8)).

(2) No prosecution against a crime under paragraph (1) 3 shall be instituted without a criminal complaint is filed by a person who has requested a confidentiality order.