Personal Data Protection 39 (4) A data user who contravenes subsection (2) commits an offence and shall, on conviction, be liable to a fine not exceeding one hundred thousand ringgit or to imprisonment for a term not exceeding one year or to both. Extent of disclosure of personal data 39. Notwithstanding section 8, personal data of a data subject may be disclosed by a data user for any purpose other than the purpose for which the personal data was to be disclosed at the time of its collection or any other purpose directly related to that purpose, only under the following circumstances: (a) the data subject has given his consent to the disclosure; (b) the disclosure — (i) is necessary for the purpose of preventing or detecting a crime, or for the purpose of investigations; or (ii) was required or authorized by or under any law or by the order of a court; (c) the data user acted in the reasonable belief that he had in law the right to disclose the personal data to the other person; (d) the data user acted in the reasonable belief that he would have had the consent of the data subject if the data subject had known of the disclosing of the personal data and the circumstances of such disclosure; or (e) the disclosure was justified as being in the public interest in circumstances as determined by the Minister. Processing of sensitive personal data 40. (1) Subject to subsection (2) and section 5, a data user shall not process any sensitive personal data of a data subject except in accordance with the following conditions: (a) the data subject has given his explicit consent to the processing of the personal data;