(1) A person described by subdivision (1)(c) of section 87-1103 shall not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer.

(2) A person who violates this section is subject to the penalty under section 87-1124.