; and (D) requiring the maintenance of adequate security measures to prevent unauthorized access to the data collected under this Act. (c) Whenever a State government or unit of local government, or any officer or employee thereof acting in an official capacity, has engaged or is engaging in any act or practice prohibited by this section, a civil action may be instituted after exhaustion of administrative remedies by the person aggrieved in an appropriate United States district court or in a State court of general jurisdiction. Administrative remedies shall be deemed to be exhausted upon the expiration of sixty days after the date the administrative complaint was filed with the Office of Justice Programs or any other administrative enforcement agency, unless within such period there has been a determination by the Office of Justice Programs or the agency on the merits of the complaint, in which case such remedies shall be deemed exhausted at the time the determination becomes final. (d) In any civil action brought by a private person to enforce compliance with any provision of this subsection, the court may grant to a prevailing plaintiff reasonable attorney fees, unless the court determines that the lawsuit is frivolous, vexatious, brought for harassment purposes, or brought principally for the purpose of gaining attorney fees. (e) In any action instituted under this section to enforce compliance with paragraph (1), the Attorney General, or a specially designated assistant for or in the name of the United States, may intervene upon timely application if he certifies that the action is of general public importance. In such action the United States shall be entitled to the same relief as if it had instituted the action. 1011. Publication of data The Department of Justice Bureau of Justice Statistics shall provide to Congress and make available to the public, together with each annual report described in section 401, the data collected pursuant to this Act, excluding any personally identifiable information