; (B) enforce compliance with section 201 or 202; or (C) impose a civil penalty in an amount that is not greater than the product of the number of individuals whose sensitive personally identifiable information was placed at risk as a result of the violation and $16,500. (2) Penalty determination (A) Determinations The determination of whether a violation of a provision of this subtitle has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this subtitle was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. (B) Additional penalty limit If a court determines under subparagraph (A) that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty, the court may not impose an additional penalty in an amount that exceeds $10,000,000. (3) Notice (A) In general Before filing an action under this subsection, the attorney general of the State involved shall provide to the Attorney General of the United States and the Federal Trade Commission— (i) a written notice of that action