(a) If a consumer-reporting agency negligently violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to:

1. (1) Notification within five business days following discovery or actual knowledge of the distribution of the information, including specificity as to the information distributed and the third-party recipient of the information.
2. (2) File a complaint with the Federal Trade Commission or the office of the Attorney General of West Virginia.

3. (3) File a civil action against the consumer-reporting agency seeking:

   1. (A) Injunctive relief to prevent or restrain further violation of the security freeze;
   2. (B) Actual damages sustained or not more than $1,000, whichever is greater; and
   3. (C) Reasonable expenses, court costs, investigative costs and attorney's fees.
4. (4) Each violation of the security freeze is a separate incident for purposes of imposing penalties under this section.

(b) If a consumer-reporting agency willfully violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to:

1. (1) Notification within five business days following discovery or actual knowledge of the distribution of the information, including specificity as to the information distributed and the third-party recipient of the information.
2. (2) File a complaint with the Federal Trade Commission or the office of the Attorney General of West Virginia.

3. (3) File a civil action against the consumer-reporting agency seeking:

   1. (A) Injunctive relief to prevent or restrain further violation of the security freeze;
   2. (B) Actual damages sustained or not more than $5,000, whichever is greater; and
   3. (C) Reasonable expenses, court costs, investigative costs and attorney's fees.
4. (4) Each violation of the security freeze is a separate incident for purposes of imposing penalties under this section.