§ 28–3864. Enforcement.

(a) A credit reporting agency that discovers a security breach of credit information in violation of a security freeze shall provide written notice to the affected consumer of the security breach of credit information in accordance with Subchapter II [of this chapter].

(b) If a credit reporting agency willfully violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer may bring a civil action against the credit reporting agency for the following:

(1) Injunctive relief to prevent or restrain further violation of the security freeze;

(2) Actual damages;

(3) Punitive damages; and

(4) Reasonable attorney’s fees and costs of the action.

(c) If a credit reporting agency negligently violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer may bring a civil action against the credit reporting agency for the following:

(1) Injunctive relief to prevent or restrain further violation of the security freeze;

(2) Actual damages; and

(3) Reasonable attorney’s fees and costs of the action.

(d)(1) The Attorney General may petition the Superior Court of the District of Columbia for temporary or permanent injunctive relief against, and for an award of restitution for property lost or damages suffered by a consumer as a consequence of, a violation of this subchapter by a credit reporting agency, or fraudulent or deceptive conduct that causes the improper release or use of credit information that is subject to a security freeze. Notwithstanding any other provision of this section, only the Attorney General shall enforce the requirements under § 28-3862(e)(2).

(2) In an action under this section, the Attorney General may recover:

(A) A civil penalty not to exceed $1,000 for each violation; and

(B) Reasonable attorney’s fees and costs of the action.