An officer or employee of a consumer reporting agency who knowingly and willfully provides information concerning an individual from the agency's files to a person not authorized to receive that information is subject to a fine of up to five thousand dollars or imprisonment for up to three hundred sixty-four days, or both.