Sec. 153. Enforcement by Attorney General

296 words·~1 min read·/bill/113/hr/4711/ih/section-153

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

The Attorney General may bring a civil action in the appropriate United States district court against any covered entity that engages in conduct constituting a violation of section 143. Upon proof of such conduct by a preponderance of the evidence, a covered entity shall be subject to a civil penalty of not more than $1,000 per individual whose personally identifiable information was or is reasonably believed to have been accessed or acquired as a result of the breach of security that is the basis of the violation, up to a maximum of $100,000 per day while such violation persists.

The total amount of the civil penalty assessed under this subsection against a covered entity for acts or omissions relating to a single breach of security shall not exceed $3,000,000, unless the conduct constituting a violation of subtitle D was reckless or repeated, in which case an additional civil penalty of up to $3,000,000 may be imposed. Beginning on the date that the Consumer Price Index is first published by the Bureau of Labor Statistics that is after 1 year after the date of the enactment of this Act, and each year thereafter, the amounts specified in paragraphs

(1)and

(2)shall be increased by the percentage increase in the Consumer Price Index published on that date from the Consumer Price Index published the previous year. If it appears that a covered entity has engaged, or is engaged, in any act or practice that constitutes a violation of subtitle D, the Attorney General may petition an appropriate United States district court for an order enjoining such practice or enforcing compliance with such subtitle. A court may issue such an order under paragraph

(c)if it finds that the conduct in question constitutes a violation of subtitle D.