Sec. 203. Federal enforcement
301 words·~1 min read·
/bill/113/s/1995/is/section-203A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Attorney General may bring a civil action in the appropriate United States district court against any business entity that engages in conduct constituting a violation of this subtitle and, upon proof of such conduct by a preponderance of the evidence, such business entity shall be subject to a civil penalty of not more than $5,000 per violation per day while such a violation exists, with a maximum of $20,000,000 per violation, unless such conduct is found to be willful or intentional.
A business entity that intentionally or willfully violates the provisions of this subtitle shall be subject to additional penalties in the amount of $5,000 per violation per day while such a violation exists. In determining the amount of a civil penalty under this subsection, the court shall take into account— the degree of culpability of the business entity; any prior violations of this subtitle by the business entity; the ability of the business entity to pay a civil penalty; the effect on the ability of the business entity to continue to do business; the number of individuals whose sensitive personally identifiable information was compromised by the breach; the relative cost of compliance with this subtitle; and such other matters as justice may require.
If it appears that a business entity has engaged, or is engaged, in any act or practice constituting a violation of this subtitle, the Attorney General may petition an appropriate district court of the United States for an order— enjoining such act or practice; or enforcing compliance with this subtitle. A court may issue an order under paragraph (1), if the court finds that the conduct in question constitutes a violation of this subtitle. The rights and remedies available under this section are cumulative and shall not affect any other rights and remedies available under law.