[2017.] Criminal Justice (Offences Relating to Information Systems) Act 2017. [No. 11.] S.8 (3) A person who commits an offence under section 7(7) shall be liable on summary conviction, to a class A fine or imprisonment for a term not exceeding 12 months or both. (4) (a) Where a court is determining the sentence to be imposed on a person for an offence under section 3 or 4, the fact that the commission of the offence involved misusing the personal data of another person (“rightful identity owner”) with the aim of gaining the trust of a third party, thereby causing prejudice to the rightful identity owner, shall be treated as an aggravating factor for the purpose of determining the sentence. (b) Accordingly, the court shall (except when the court considers that there are exceptional circumstances justifying it not doing so) impose a sentence that is greater than that which would have been imposed in the absence of such a factor. (c) The sentence imposed shall not be greater than the maximum sentence permissible under this section for the offence concerned under section 3 or 4. Liability for offences by body corporate, etc. 9. (1) Where a relevant offence (other than an offence under this subsection) is committed for the benefit of a body corporate by a relevant person and the commission of the relevant offence is attributable to the failure, by a director, manager, secretary or other officer of the body corporate, or a person purporting to act in that capacity, to exercise, at the time of the commission of the relevant offence and in all the circumstances of the case, the requisite degree of supervision or control of the relevant person, the body corporate shall be guilty of an offence. (2) In proceedings for an offence under subsection (1), it shall be a defence for a body corporate against which such proceedings are brought to prove that it took all reasonable steps and exercised all due diligence to avoid the commission of the offence. (3) Where an offence under this Act is committed by a body corporate and it is proved that the offence was committed with the consent or connivance, or was attributable to any wilful neglect, of a person who was a director, manager, secretary or other officer of the body corporate, or a person purporting to act in that capacity, that person shall, as well as the body corporate, be guilty of an offence and shall be liable to be proceeded against and punished as if he or she were guilty of the first-mentioned offence. (4) Subsection (1)— (a) is without prejudice to the other circumstances, under the general law, whereby acts of a natural person are attributed to a body corporate resulting in criminal liability of that body corporate for those acts, and (b) does not exclude criminal proceedings against natural persons who are involved as perpetrators, inciters or accessories in an offence under this Act. (5) In this section— 7