§ 34 DSG NRW
Criminal offences
(1)Any person who, in the exercise of his or her activity for a public body, commits one of the violations referred to in Section 33(1) for payment or with the intent to enrich himself or herself or another person or to harm another person, shall be punished with imprisonment for a term not exceeding two years or with a fine. Attempt shall be punishable.
(2)The offence shall be prosecuted only upon application. The data subject, the controller, the processor and the State Commissioner for Data Protection and Freedom of Information shall be entitled to file an application.
(3)Paragraph 1 shall apply only insofar as the offence is not subject to a more severe penalty under other provisions.
(4)Part 3 Transposition of Directive (EU) 2016/680
(5)General provisions