; (ii) databases owned by the Federal Government; or (iii) means of identification of Federal Government employees or contractors involved in national security matters or law enforcement; and (B) the term means of identification has the meaning given that term in section 1028 of title 18, United States Code. II Non-criminal privacy enforcement and privacy impact statements 201. Enforcement by Attorney General and State authorities (a) Definition of authorized entity As used in this section, the term authorized entity means the Attorney General, with respect to any conduct constituting a violation of a Federal law enacted after the date of the enactment of this Act relating to data security and engaged in by a business entity, and a State Attorney General with respect to that conduct to the extent the conduct adversely affects an interest of the residents of a State. (b) Civil penalty (1) Generally An authorized entity may in a civil action obtain a civil penalty of not more than $500,000 from any business entity that engages in conduct constituting a violation of a Federal law enacted after the date of the enactment of this Act relating to data security. (2) Special rule for intentional violation If the violation described in subsection (a) is intentional, the maximum civil penalty is $1,000,000. (c) Injunctive relief An authorized entity may, in a civil action against a business entity that has engaged, or is engaged, in any conduct constituting a violation of a Federal law enacted after the date of the enactment of this Act relating to data security, obtain an order— (1) enjoining such act or practice