§ 40-12-508 — Violations; penalties

(a) If a consumer reporting agency intentionally or
negligently violates a valid security freeze by releasing credit
information that has been placed under a security freeze, the
affected consumer is entitled to:
(i) Notification within five (5) business days
following the agency's discovery, or notification from another
source, of the release of the information. The notification
under this paragraph shall include specificity as to the
information released and the third party recipient of the
information;
(ii) Notification that the consumer may file a
complaint with the federal trade commission and the state
attorney general.
(b) If a consumer reporting agency intentionally or
negligently violates a valid security freeze by releasing credit
information that has been placed under a security freeze and
fails to take steps to correct the release and fails to give the
notification required under subsection (a) of this section, the
affected consumer is entitled to, in a civil action against the
consumer reporting agency, recover:
(i) Injunctive relief to prevent or restrain further
violation of the security freeze;
(ii) A civil penalty in an amount not to exceed one
thousand dollars ($1,000.00) plus any damages available under
other civil laws; and
(iii) Reasonable expenses, court costs, investigative
costs and attorney's fees.
(c) Each violation of the security freeze shall be counted
as a separate incident for purposes of imposing penalties under
this section.