of up to BGN 6,000. (5) (New, SG No. 101/2017) The punishment shall be imprisonment from five to eight years and a fine of up to BGN 10,000, when the act under Paragraph 1: 1. is committed by a person acting upon an order or decision of an organised crime group. 2. is committed against an information system which is part of a critical infrastructure. Article 319c (1) (Supplemented, SG No. 38/2007, amended, SG No. 101/2017) Anyone who commits an act under Article 319b with regard to data provided by virtue of law, electronically or on other carriers shall be punished to imprisonment of up to three years and a fine of up to BGN 3,000. (2) (Supplemented, SG No. 101/2017) Where the act under Paragraph 1 was intended to prevent the fulfilment of an obligation, the punishment shall be imprisonment from one to three years and a fine of up to BGN 5,000. Article 319d (1) (Amended, SG No. 38/2007, amended and supplemented, SG No. 101/2017) Anyone who introduces a computer virus into an information system or a computer network, shall be punished by imprisonment of up to three years and a fine of up to BGN 3,000. (2) (New, SG No. 38/2007, amended, SG No. 101/2017) The punishment under Paragraph 1 shall be imposed also on a person who introduces another computer programme which is intended to disrupt the operation of an information system or a computer network or for obtaining information, erasing, deleting, modifying or copying computer data without permission, where such permission is required, to the extent the act does not constitute a graver crime. (3) (Renumbered from Paragraph 2, amended, SG No. 38/2007, SG No. 101/2017) Where considerable damages have occurred as a result of the act under Paragraphs 1 and 2 or it has been repeated, the punishment shall be imprisonment of up to five years and a fine of up to BGN 3,000. Article 319e (1) (Amended, SG No. 26/2004, SG No. 38/2007, SG No. 101/2017) A person who creates, obtains for himself/herself or for someone else, imports or otherwise distributes computer programmes, passwords, codes or other similar data for access to an information system or part thereof in order to commit a crime under Article 171 (3), Article 319a, Article 319b, Article 319c or Article 319d shall be punished to imprisonment of up to two years. (2) (Supplemented, SG No. 38/2007, amended, SG No. 101/2017) When with the act under Paragraph 1 personal data, classified information or another secret protected by law is disclosed, insofar as the breach does not constitute a graver offence, the punishment shall be imprisonment of up to three years. (3) (New, SG No. 101/2017) If the act under Paragraph 1 was committed for a venal goal or by a person acting on an order or in pursuance of a decision of an organised criminal group or where it has caused considerable damages or other grave consequences have occurred, the punishment shall be imprisonment of up to five years. Article 319f (Amended, SG No. 85/2017) Where a provider of information services acting in this capacity violates provision of