2. Notification to information broker.__A person that maintains, on behalf of an information broker, computerized data that includes personal information that the person does not own shall notify the information broker of a breach of the security of the system immediately following discovery if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

3.__Delay of notification for law enforcement purposes.__The notification required by this section may be delayed if a law enforcement agency determines that the notification will compromise a criminal investigation; the notification required by this section must be made after the law enforcement agency determines that it will not compromise the investigation.

4.__Notification to consumer reporting agencies.__If an information broker discovers a breach of the security of the system that requires notification to more than 1,000 persons at a single time, the information broker shall also notify, without unreasonable delay, consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 United States Code, Section 1681a(p).

5.__Notification to state regulators.__When notice of a breach of the security of the system is required under subsection 1, the information broker shall notify the appropriate state regulators within the Department of Professional and Financial Regulation, or if the information broker is not regulated by the department, the Attorney General.

§1349.__Enforcement; penalties

1.__Enforcement.__The appropriate state regulators within the Department of Professional and Financial Regulation shall enforce this chapter for any information broker that is licensed or regulated by those regulators.__The Attorney General shall enforce this chapter for all other information brokers.

2.__Civil violation.__An information broker that violates this chapter commits a civil violation and is subject to one or more of the following:

A.__A fine of not more than $500 per violation, up to a maximum of $2,500 for each day the information broker is in violation of this chapter;