; and (B) with respect to which the consumer reporting agency shall, as soon as practicable after the date on which the consumer assistance unit is established, notify each affected individual with respect to the data breach by mail and e-mail. (c) Enforcement (1) In general Subject to subtitle B of the Consumer Financial Protection Act of 2010 ( 12 U.S.C. 5511 et seq.), the Federal Trade Commission or the Bureau may bring a civil action to recover a civil penalty in an appropriate district court of the United States against any person that negligently, knowingly, or willingly causes a data breach at a consumer reporting agency. (2) Penalty amount (A) In general In a successful action brought under paragraph (1), the person against which the action is brought shall be liable for a civil penalty of not more than— (i) $2,500 for each affected individual with respect to the data breach caused by the person; and (ii) $25,000,000 in total. (B) Considerations In determining the amount of a civil penalty in a successful action brought under paragraph (1), the court shall consider, with respect to the person against which the action is brought— (i) the degree of culpability of the person; (ii) any history of similar prior conduct by the person; (iii) the ability of the person to pay; (iv) the effect of the penalty on the ability of the person to continue to do business; and (v) any other factor as justice may require. (3) Private cause of action (A) Definition In this paragraph, the term actual loss means the total cost to an affected individual as a result of a data breach at a consumer reporting agency, including— (i) the costs incurred by the affected individual— (I) in responding to the data breach; and (II) as a result of— (aa) reviewing accounts of the affected individual for fraudulent charges; (bb) closing accounts of the affected individual that may have been compromised by the data breach; and (cc) imposing credit freezes and obtaining credit monitoring services