; and (ii) an additional $50 for each additional item of personally identifying information compromised for each consumer. (B) Exception (i) In general Except as provided in clause (ii), a court may not impose a civil penalty under this subsection in an amount greater than 50 percent of the gross revenue of the covered consumer reporting agency for the previous fiscal year before the date on which the covered consumer reporting agency became aware of the covered breach. (ii) Penalty doubled A court shall impose a civil penalty on a covered consumer reporting agency double the penalty described in subparagraph (A), but not greater than 75 percent of the gross revenue of the covered consumer reporting agency for the previous fiscal year before the date on which the covered consumer reporting agency became aware of the covered breach if— (I) the covered consumer reporting agency fails to notify the Commission of a covered breach before the deadline established under subsection (a); or (II) the covered consumer reporting agency violates any regulation promulgated under section 3(b)(1)(C). (3) Proceeds of the penalties Of the penalties assessed under this subsection— (A) 50 percent shall be used for cybersecurity research and inspections by the Office of Cybersecurity; and (B) 50 percent shall be used by the Commission to be divided fairly among consumers affected by the covered breach. (4) No preemption Nothing in this subsection shall preclude an action by a consumer under State or other Federal law. (c) Injunctive relief The Commission may bring suit in a district court of the United States or in the United States court of any Territory to enjoin a covered consumer reporting agency to implement or correct a particular security measure in order to promote effective security. 5. Authorization of appropriations There are authorized to be appropriated $100,000,000 to carry out this Act, to remain available until expended.