; or (2) notification to individuals of a breach of security of the personal information defined in section 5(6)(A), or as subsequently amended by the Commission under section 5(6)(B), by covered entities, as defined in section 5(4). (b) Effect on State law In the case of a provision of the law of a State that is superseded by subsection (a), this Act may be enforced in the same manner and to the same extent as the State law could have been enforced under State law had the provision of the law of the State not been superseded. (c) Effect on other State laws Except as provided in subsection (a), nothing in this Act shall be construed to— (1) preempt or limit any provision of any law, rule, regulation, requirement, standard, or other provision having the force and effect of law of any State, including any State consumer protection law, any State law relating to acts of fraud or deception, and any State trespass, contract, or tort law; (2) preempt or limit any provision of any law, rule, regulation, requirement, standard, or other provision having the force and effect of law of any State regarding post-data breach services, including security or credit freezes, credit monitoring, identity theft monitoring, and identity theft services; (3) prevent or limit the attorney general of a State from exercising the powers conferred upon the attorney general by the laws of the State, including conducting investigations, administering oaths or affirmations, or compelling the attendance of witnesses or the production of documentary and other evidence