Section 37. Penalty for disclosing identity information

37. Penalty for disclosing identity information.— Whoever, intentionally discloses, transmits, copies or otherwise disseminates any identity information collected in the course of enrolment or authentication to any person not authorised under this Act or regulations made thereunder or in contravention of any agreement or arrangement entered into pursuant to the provisions of this Act, shall be punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both. — 38. Penalty for unauthorised access to the Central Identities Data Repository. Whoever, not being authorised by the Authority, intentionally,— (a) accesses or secures access to the Central Identities Data Repository; (b) downloads, copies or extracts any data from the Central Identities Data Repository or stored in any removable storage medium; (c) introduces or causes to be introduced any virus or other computer contaminant in the Central Identities Data Repository; (d) damages or causes to be damaged the data in the Central Identities Data Repository; (e) disrupts or causes disruption of the access to the Central Identities Data Repository; (f) denies or causes a denial of access to any person who is authorised to access the Central Identities Data Repository; (g) reveals any information in contravention of sub-section (5) of section 28, or shares, uses or displays information in contravention of section 29 or assists any person in any of the aforementioned acts; (h) destroys, deletes or alters any information stored in any removable storage media or in the Central Identities Data Repository or diminishes its value or utility or affects it injuriously by any means; or (i) steals, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used by the Authority with an intention to cause damage, shall be punishable with imprisonment for a term which may extend to[1] [ten years] and shall also be liable to a fine which shall not be less than ten lakh rupees. — Explanation. For the purposes of this section, the expressions "computer contaminant", "computer virus" and "damage" shall have the meanings respectively assigned to them in the Explanation to section 43 of the Information Technology Act, 2000 (21 of 2000), and the expression "computer source code" shall have the meaning assigned to it in the Explanation to section 65 of the said Act. — 39. Penalty for tampering with data in Central Identities Data Repository. Whoever, not being authorised by the Authority, uses or tampers with the data in the Central Identities Data Repository or in any removable storage medium with the intent of modifying information relating to Aadhaar number holder or discovering any information thereof, shall be punishable with imprisonment for a term which may extend to[2] [ten years] and shall also be liable to a fine which may extend to ten thousand rupees. 3 [ 40. Penalty for unauthorised use by requesting entity or offline verification-seeking entity .— Whoever,—(a) being a requesting entity, uses the identity information of an individual in contravention of sub-section (2) of section 8; or (b) being an offline verification-seeking entity, uses the identity information of an individual in contravention of sub-section (2) of section 8A, shall be punishable with imprisonment which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.] — 41. Penalty for non-compliance with intimation requirements. Whoever, being an enrolling agency or a requesting entity, fails to comply with the requirements of sub-section (2) of section 3 or subsection (3) of section 8, shall be[4] [liable to penalty which may extend to one lakh rupees, or in the case of a company, with penalty which may extend to ten lakh rupees]. — 42. General penalty. Whoever commits an offence under this Act or any rules or regulations made thereunder for which no specific penalty is provided elsewhere than this section, shall be punishable with imprisonment for a term which may extend to[[5]] [three year] or with a fine which may extend to twenty-five thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees, or with both. imprisonment for a term which may extend to[[5]] [three year] or with a fine which may extend to